fix(auditlog,health): harden hosted-service shutdown against disposed CTS

The host does not guarantee IHostedService.StopAsync is driven before the DI
container is disposed — WebApplicationFactory's teardown reaches Dispose first
— so cancelling the internal CTS from StopAsync threw ObjectDisposedException
and aborted the host's whole shutdown sequence. Four services shared the same
copy-pasted lifecycle and the same two races: StopAsync cancelling an already-
disposed CTS, and StartAsync reading _cts.Token lazily inside the Task.Run
lambda, which faults the loop task the host awaits when Dispose wins that race.

Each service now captures the token on the caller's thread, tolerates a
disposed CTS, and cancels-before-disposing so the loop is always signalled and
its pending Task.Delay sees a cancelled token rather than a dead source.
SiteAuditBacklogReporter also gains the outer OperationCanceledException guard
its sibling SiteAuditRetentionService already carried (arch-review 04 R2, R7),
without which a shutdown landing mid-probe threw TaskCanceledException out of
Host.StopAsync.

Surfaced while verifying the Gitea #15 test-harness fix: in Host.Tests the
aborted teardown skipped the fixture's env-var restore, contaminating every
later test in the run.

Refs: Gitea #15

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Central/AuditLogPartitionMaintenanceServiceTests.cs

@@ -151,4 +151,40 @@ public class AuditLogPartitionMaintenanceServiceTests
         Assert.Equal(LogLevel.Error, errorEntry.Level);
         Assert.Equal(1, maintenance.EnsureCallCount);
     }
+
+    [Fact]
+    public async Task StopAsync_AfterDispose_DoesNotThrow()
+    {
+        // Regression (Gitea #15 follow-up): Dispose tears down the CTS that
+        // StopAsync cancels, and the host does not guarantee that every
+        // IHostedService.StopAsync is driven before the DI container is
+        // disposed — WebApplicationFactory's teardown reaches Dispose first and
+        // then calls StopAsync. Cancel() on a disposed CTS throws
+        // ObjectDisposedException, and letting it escape aborts the host's whole
+        // shutdown sequence (in Host.Tests it stranded the fixture's env-var
+        // restore, contaminating every later test in the run). Stop-after-Dispose
+        // must therefore be a no-op, not a throw.
+        var opts = Options.Create(new AuditLogPartitionMaintenanceOptions
+        {
+            IntervalSeconds = 60,
+            LookaheadMonths = 1,
+        });
+        var maintenance = new RecordingMaintenance();
+        var sp = BuildProvider(maintenance);
+
+        var svc = new AuditLogPartitionMaintenanceService(
+            sp.GetRequiredService<IServiceScopeFactory>(),
+            opts,
+            NullLogger<AuditLogPartitionMaintenanceService>.Instance);
+
+        await svc.StartAsync(CancellationToken.None);
+
+        svc.Dispose();
+
+        // The assertion is the absence of ObjectDisposedException.
+        await svc.StopAsync(CancellationToken.None);
+
+        // Dispose is also idempotent — the host may reach it twice on the same path.
+        svc.Dispose();
+    }
 }