feat(comm): T1B.3 — central-side gRPC site-command transport seam (default Akka)

Extract the central→site send path in CentralCommunicationActor behind a new
ISiteCommandTransport, selected by ScadaBridge:Communication:SiteTransport
(Akka | Grpc, default Akka — rollback = flip the flag). CommunicationService's
27 commands, SiteCallAuditActor's 2 parked relays and DebugStreamBridgeActor's
subscribe/unsubscribe are untouched; the seam sits below SiteEnvelope.

- AkkaSiteTransport: today's per-site ClusterClient path extracted verbatim
  (the _siteClients lookup + ClusterClient.Send with the reply-to sender
  preserved, and the "no client ⇒ warn + drop, caller's Ask times out" path).
- GrpcSiteTransport: dials the site SiteCommandService (T1B.1 proto client) via
  SiteCommandDtoMapper, PSK + x-scadabridge-site on the channel through
  ControlPlaneCredentials, per-command deadlines set EQUAL to today's
  CommunicationService Ask timeouts (per-command, not per-group: DeploymentState
  query and TriggerSiteFailover use QueryTimeout; the two parked relays map to
  QueryTimeout so SiteCallAudit's inner RelayTimeout 10s < 30s ordering holds;
  WaitForAttribute keeps its dynamic Timeout + IntegrationTimeout).
- SitePairChannelProvider: per-site A/B channel pair with sticky failover
  (flip only on Unavailable — NEVER on DeadlineExceeded, a write/deploy/failover
  may have run), background failback probe to the preferred node with 1s→60s
  doubling backoff, PSK invalidation on site removal. Fed by the SAME DB refresh
  loop (extended to carry GrpcNodeA/GrpcNodeBAddress) — no second poll.

Tests: actor-with-substitute-transport (routing, Ask-reply plumbing, per-site
lifecycle across refreshes), ResolveDeadline pinned to each command's current
Ask timeout, and GrpcSiteTransport/SitePairChannelProvider over dual in-process
TestServers (PSK+header+deadline attached, Unavailable failover + stickiness,
failback to preferred, no-retry-on-DeadlineExceeded). Proto csproj untouched
(no active <Protobuf> item). Full solution builds 0 warnings; Communication.Tests
607 green with Akka default.

src/ZB.MOM.WW.ScadaBridge.Communication/CommunicationOptions.cs

@@ -1,6 +1,5 @@
 namespace ZB.MOM.WW.ScadaBridge.Communication;
 
-/// <summary>
 /// Which transport carries the seven site→central control messages. Selected per node by
 /// <c>ScadaBridge:Communication:CentralTransport</c>; the migration ships with
 /// <see cref="Akka"/> as the default so nothing flips until a node opts in.
@@ -14,6 +13,21 @@ public enum CentralTransportMode
     Grpc = 1,
 }
 
+/// <summary>
+/// Selects the transport the central→site command plane rides on. The Akka
+/// per-site <c>ClusterClient</c> path is the default until the gRPC cutover
+/// (ClusterClient→gRPC migration, Phase 1B); flipping to <see cref="Grpc"/> is the
+/// rollback-by-flag switch.
+/// </summary>
+public enum SiteTransportKind
+{
+    /// <summary>Route <c>SiteEnvelope</c>s through the per-site Akka <c>ClusterClient</c> (today's default).</summary>
+    Akka,
+
+    /// <summary>Route <c>SiteEnvelope</c>s over the site <c>SiteCommandService</c> gRPC plane.</summary>
+    Grpc
+}
+
 /// <summary>
 /// Configuration options for central-site communication, including per-pattern
 /// timeouts and transport heartbeat settings.
@@ -39,6 +53,15 @@ public class CommunicationOptions
     /// </remarks>
     public List<string> CentralGrpcEndpoints { get; set; } = new();
 
+    /// <summary>
+    /// Which transport the central→site command plane uses. Default <see cref="SiteTransportKind.Akka"/>
+    /// (the per-site ClusterClient path) — flipping to <see cref="SiteTransportKind.Grpc"/> moves
+    /// every <c>SiteEnvelope</c> onto the site <c>SiteCommandService</c> gRPC plane. Selected inside
+    /// <c>CentralCommunicationActor</c>; <c>CommunicationService</c> and <c>SiteCallAuditActor</c>
+    /// are unchanged either way. Rollback at any point = flip this back to <c>Akka</c>.
+    /// </summary>
+    public SiteTransportKind SiteTransport { get; set; } = SiteTransportKind.Akka;
+
     /// <summary>Timeout for deployment commands (typically longest due to apply logic).</summary>
     public TimeSpan DeploymentTimeout { get; set; } = TimeSpan.FromMinutes(2);