perf(misc): cached hot-path lookups, bounded observer queue, alarm-priority stream path

WP2.6 (arch-review remediation, cross-cutting misc):
- SiteExternalSystemRepository: name/ID-indexed ExternalSystemDefinitionCache replaces
  the fetch-all + reverse-map scan on every by-ID/method lookup; loaded once per
  redeploy, invalidated by DeploymentManagerActor after HandleDeployArtifacts applies
  external-system changes. Static JsonSerializerOptions for method-list parsing.
- Inbound API: short-TTL ApiMethodCache fronts the per-request ApiMethod repository
  fetch; invalidated by name via the existing ScriptArtifactChangeSubscriber/
  IScriptArtifactChangeBus pipeline, self-healing via TTL for changes the bus
  doesn't cover (e.g. Management API edits).
- StoreAndForward: the cached-call audit-observer queue — the one unbounded channel
  left in the system — is now bounded (ObserverQueueCapacity, default 10,000) with
  DropOldest overflow and a dropped-notification counter.
- SiteStreamManager: alarm state changes now travel a dedicated publish
  source/broadcast hub, isolated from the (far higher-volume) attribute path, so an
  attribute storm can no longer evict a pending alarm transition; the alarm hand-off
  queue is bounded with a drop counter surfaced on the site health report
  (SiteStreamAlarmDropCount via the new SiteStreamAlarmDropReporter), and publishing
  is skipped entirely at zero subscribers on either path.
- CLI ManagementHttpClient: explicit 30s HttpClient.Timeout on the shared
  construction (was the 100s framework default), overridable via
  SCADABRIDGE_HTTP_TIMEOUT_SECONDS.

Deviation: the failback-probe heartbeat item is NOT included — its only viable
surface (CentralChannelProvider.cs / heartbeat consumers) lives entirely in the
Communication project, explicitly off-limits to this work package this phase.

Tests: SiteRuntime.Tests (550), InboundAPI.Tests (278), StoreAndForward.Tests (133),
CLI.Tests (390), HealthMonitoring.Tests (97) — all green after full solution build.

src/ZB.MOM.WW.ScadaBridge.InboundAPI/ScriptArtifactChangeSubscriber.cs

@@ -27,20 +27,27 @@ namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
 public sealed class ScriptArtifactChangeSubscriber : IHostedService
 {
     private readonly InboundScriptExecutor _executor;
+    private readonly ApiMethodCache _methodCache;
     private readonly ILogger<ScriptArtifactChangeSubscriber> _logger;
     private readonly IScriptArtifactChangeBus? _bus;
     private IDisposable? _subscription;
 
     /// <summary>Initializes the subscriber.</summary>
     /// <param name="executor">The compiled-handler cache to invalidate.</param>
+    /// <param name="methodCache">
+    /// WP2.6b: the short-TTL resolved-<c>ApiMethod</c>-row cache to invalidate alongside
+    /// the compiled handler.
+    /// </param>
     /// <param name="logger">Logger instance.</param>
     /// <param name="bus">The change bus, or null when the host registers none (site roles, tests).</param>
     public ScriptArtifactChangeSubscriber(
         InboundScriptExecutor executor,
+        ApiMethodCache methodCache,
         ILogger<ScriptArtifactChangeSubscriber> logger,
         IScriptArtifactChangeBus? bus = null)
     {
         _executor = executor;
+        _methodCache = methodCache;
         _logger = logger;
         _bus = bus;
     }
@@ -78,6 +85,7 @@ public sealed class ScriptArtifactChangeSubscriber : IHostedService
         foreach (var name in notification.Names)
         {
             _executor.InvalidateMethod(name);
+            _methodCache.Invalidate(name);
         }
 
         _logger.LogInformation(