fix(security): enforce LDAP-mapping site scope on secured-write submit/approve/reject (plan R2-07 T4)

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -1247,6 +1247,11 @@ public class ManagementActor : ReceiveActor
         var site = await siteRepo.GetSiteByIdentifierAsync(cmd.SiteId)
             ?? throw new ManagementCommandException($"Site '{cmd.SiteId}' not found.");
 
+        // Site scope (arch-review R2 N3): an LDAP-mapping-scoped Operator may only
+        // submit device writes to their permitted sites — same rule C2 applies to
+        // DeployArtifacts, on a higher-consequence path. Checked before the row exists.
+        EnforceSiteScope(user, site.Id);
+
         var connections = await siteRepo.GetDataConnectionsBySiteIdAsync(site.Id);
         var conn = connections.FirstOrDefault(c =>
             string.Equals(c.Name, cmd.ConnectionName, StringComparison.Ordinal))
@@ -1293,6 +1298,11 @@ public class ManagementActor : ReceiveActor
             throw new ManagementCommandException(
                 $"Secured write {cmd.Id} is '{row.Status}', not Pending; it cannot be approved.");
 
+        // Site scope (arch-review R2 N3): the approving Verifier must be permitted on
+        // the row's target site — checked BEFORE the TTL/self-approval/CAS chain so an
+        // out-of-scope verifier can neither consume the Pending transition nor relay.
+        await EnforceSiteScopeForIdentifier(sp, user, row.SiteId);
+
         // Server-side TTL: a Pending write older than the configured age is transitioned
         // to Expired and can never be approved — the stale setpoint is never relayed
         // (arch-review S2). Checked BEFORE the self-approval/CAS so an overdue row never
@@ -1450,6 +1460,10 @@ public class ManagementActor : ReceiveActor
             throw new ManagementCommandException(
                 $"Secured write {cmd.Id} is '{entity.Status}', not Pending; it cannot be rejected.");
 
+        // Site scope (arch-review R2 N3): the rejecting Verifier must be permitted on
+        // the row's target site — checked BEFORE the TTL/self-approval chain.
+        await EnforceSiteScopeForIdentifier(sp, user, entity.SiteId);
+
         // Server-side TTL: an overdue Pending write expires here too, so a reject on a
         // stale row deterministically reports the expiry rather than recording a
         // human decision (arch-review S2).