perf(misc): cached hot-path lookups, bounded observer queue, alarm-priority stream path

WP2.6 (arch-review remediation, cross-cutting misc):
- SiteExternalSystemRepository: name/ID-indexed ExternalSystemDefinitionCache replaces
  the fetch-all + reverse-map scan on every by-ID/method lookup; loaded once per
  redeploy, invalidated by DeploymentManagerActor after HandleDeployArtifacts applies
  external-system changes. Static JsonSerializerOptions for method-list parsing.
- Inbound API: short-TTL ApiMethodCache fronts the per-request ApiMethod repository
  fetch; invalidated by name via the existing ScriptArtifactChangeSubscriber/
  IScriptArtifactChangeBus pipeline, self-healing via TTL for changes the bus
  doesn't cover (e.g. Management API edits).
- StoreAndForward: the cached-call audit-observer queue — the one unbounded channel
  left in the system — is now bounded (ObserverQueueCapacity, default 10,000) with
  DropOldest overflow and a dropped-notification counter.
- SiteStreamManager: alarm state changes now travel a dedicated publish
  source/broadcast hub, isolated from the (far higher-volume) attribute path, so an
  attribute storm can no longer evict a pending alarm transition; the alarm hand-off
  queue is bounded with a drop counter surfaced on the site health report
  (SiteStreamAlarmDropCount via the new SiteStreamAlarmDropReporter), and publishing
  is skipped entirely at zero subscribers on either path.
- CLI ManagementHttpClient: explicit 30s HttpClient.Timeout on the shared
  construction (was the 100s framework default), overridable via
  SCADABRIDGE_HTTP_TIMEOUT_SECONDS.

Deviation: the failback-probe heartbeat item is NOT included — its only viable
surface (CentralChannelProvider.cs / heartbeat consumers) lives entirely in the
Communication project, explicitly off-limits to this work package this phase.

Tests: SiteRuntime.Tests (550), InboundAPI.Tests (278), StoreAndForward.Tests (133),
CLI.Tests (390), HealthMonitoring.Tests (97) — all green after full solution build.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ServiceCollectionExtensions.cs

@@ -65,8 +65,16 @@ public static class ServiceCollectionExtensions
         // construction, which is what runs SiteLocalDbSetup.OnReady.
         services.AddSingleton<Commons.Interfaces.IOperationTrackingStore, Tracking.OperationTrackingStore>();
 
-        // Site-local repository implementations backed by SQLite
-        services.AddScoped<IExternalSystemRepository, SiteExternalSystemRepository>();
+        // Site-local repository implementations backed by SQLite.
+        // WP2.6a: ExternalSystemDefinitionCache is a singleton shared by every scoped
+        // SiteExternalSystemRepository instance (one per script-execution DI scope), so
+        // resolving the repository repeatedly does not each pay a fresh SQLite
+        // fetch-all — DeploymentManagerActor invalidates the shared cache after an
+        // artifact deploy applies external-system changes.
+        services.AddSingleton<ExternalSystemDefinitionCache>();
+        services.AddScoped<IExternalSystemRepository>(sp => new SiteExternalSystemRepository(
+            sp.GetRequiredService<SiteStorageService>(),
+            sp.GetRequiredService<ExternalSystemDefinitionCache>()));
 
         // Notify-and-fetch: typed HttpClient for fetching deployment configs from central.
         services.AddHttpClient<IDeploymentConfigFetcher, HttpDeploymentConfigFetcher>()
@@ -83,6 +91,13 @@ public static class ServiceCollectionExtensions
             sp.GetRequiredService<IOptions<SiteRuntimeOptions>>().Value,
             sp.GetRequiredService<ILogger<ScriptSchedulerStatsReporter>>()));
 
+        // WP2.6d: periodically lift SiteStreamManager's alarm-publish-queue drop count
+        // onto the site health report.
+        services.AddHostedService(sp => new Streaming.SiteStreamAlarmDropReporter(
+            sp.GetRequiredService<HealthMonitoring.ISiteHealthCollector>(),
+            sp.GetRequiredService<SiteStreamManager>(),
+            sp.GetRequiredService<ILogger<Streaming.SiteStreamAlarmDropReporter>>()));
+
         return services;
     }