fix(auditlog,health): harden hosted-service shutdown against disposed CTS

The host does not guarantee IHostedService.StopAsync is driven before the DI
container is disposed — WebApplicationFactory's teardown reaches Dispose first
— so cancelling the internal CTS from StopAsync threw ObjectDisposedException
and aborted the host's whole shutdown sequence. Four services shared the same
copy-pasted lifecycle and the same two races: StopAsync cancelling an already-
disposed CTS, and StartAsync reading _cts.Token lazily inside the Task.Run
lambda, which faults the loop task the host awaits when Dispose wins that race.

Each service now captures the token on the caller's thread, tolerates a
disposed CTS, and cancels-before-disposing so the loop is always signalled and
its pending Task.Delay sees a cancelled token rather than a dead source.
SiteAuditBacklogReporter also gains the outer OperationCanceledException guard
its sibling SiteAuditRetentionService already carried (arch-review 04 R2, R7),
without which a shutdown landing mid-probe threw TaskCanceledException out of
Host.StopAsync.

Surfaced while verifying the Gitea #15 test-harness fix: in Host.Tests the
aborted teardown skipped the fixture's env-var restore, contaminating every
later test in the run.

Refs: Gitea #15

src/ZB.MOM.WW.ScadaBridge.HealthMonitoring/SiteEventLogFailureCountReporter.cs

@@ -85,8 +85,14 @@ public sealed class SiteEventLogFailureCountReporter : IHostedService, IDisposab
         // Linked CTS lets StopAsync's cancellation AND the host's shutdown
         // token both terminate the loop; either side firing aborts the
         // pending Task.Delay.
-        _cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
-        _loop = Task.Run(() => RunLoopAsync(_cts.Token));
+        var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        _cts = cts;
+
+        // Read Token on the caller's thread, not inside the lambda: the lambda runs
+        // whenever the thread pool gets to it, so a Dispose landing first would make
+        // the deferred _cts.Token read throw and fault the loop task the host awaits.
+        var token = cts.Token;
+        _loop = Task.Run(() => RunLoopAsync(token), CancellationToken.None);
         return Task.CompletedTask;
     }
 
@@ -134,13 +140,35 @@ public sealed class SiteEventLogFailureCountReporter : IHostedService, IDisposab
     /// <returns>A task that represents the asynchronous operation.</returns>
     public Task StopAsync(CancellationToken ct)
     {
-        _cts?.Cancel();
+        try
+        {
+            _cts?.Cancel();
+        }
+        catch (ObjectDisposedException)
+        {
+            // Stop-after-Dispose is a legal ordering; Dispose already cancelled the
+            // loop. Letting this escape would abort the host's shutdown sequence.
+        }
+
         return _loop ?? Task.CompletedTask;
     }
 
     /// <summary>Releases the internal <see cref="CancellationTokenSource"/> used to stop the polling loop.</summary>
     public void Dispose()
     {
+        // Cancel before disposing so the loop is always signalled even when the host
+        // disposes the container without having driven StopAsync first, and so the
+        // loop's pending Task.Delay(interval, token) sees an already-cancelled token
+        // rather than registering against a dead source.
+        try
+        {
+            _cts?.Cancel();
+        }
+        catch (ObjectDisposedException)
+        {
+            // Already disposed — Dispose is idempotent.
+        }
+
         _cts?.Dispose();
     }
 }