fix(security): additive permitted-sites filter on secured-write query/count (plan R2-07 T5)

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/ISecuredWriteRepository.cs

@@ -46,6 +46,11 @@ public interface ISecuredWriteRepository
     /// <param name="siteId">Site id filter; <c>null</c> matches every site.</param>
     /// <param name="skip">Number of rows to skip (offset paging).</param>
     /// <param name="take">Maximum number of rows to return.</param>
+    /// <param name="permittedSiteIds">When non-null, only rows whose <c>SiteId</c> (site
+    /// identifier) is in the set match; <c>null</c> matches every site. Applied IN ADDITION
+    /// to <paramref name="siteId"/>. Used by the ManagementActor to constrain an unfiltered
+    /// list to a site-scoped caller's permitted sites at the query level (arch-review R2 N3),
+    /// so paging and totals stay correct.</param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A task that resolves to a page of matching rows, newest submission first.</returns>
     Task<IReadOnlyList<PendingSecuredWrite>> QueryAsync(
@@ -53,6 +58,7 @@ public interface ISecuredWriteRepository
         string? siteId,
         int skip,
         int take,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
         CancellationToken ct = default);
 
     /// <summary>
@@ -106,7 +112,16 @@ public interface ISecuredWriteRepository
     /// </summary>
     /// <param name="status">Status filter; <c>null</c> matches every status.</param>
     /// <param name="siteId">Site id filter; <c>null</c> matches every site.</param>
+    /// <param name="permittedSiteIds">When non-null, only rows whose <c>SiteId</c> (site
+    /// identifier) is in the set match; <c>null</c> matches every site. Applied IN ADDITION
+    /// to <paramref name="siteId"/>. Used by the ManagementActor to constrain an unfiltered
+    /// list to a site-scoped caller's permitted sites at the query level (arch-review R2 N3),
+    /// so paging and totals stay correct.</param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A task that resolves to the count of matching rows.</returns>
-    Task<int> CountAsync(string? status, string? siteId, CancellationToken ct = default);
+    Task<int> CountAsync(
+        string? status,
+        string? siteId,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
+        CancellationToken ct = default);
 }