perf(misc): cached hot-path lookups, bounded observer queue, alarm-priority stream path

WP2.6 (arch-review remediation, cross-cutting misc):
- SiteExternalSystemRepository: name/ID-indexed ExternalSystemDefinitionCache replaces
  the fetch-all + reverse-map scan on every by-ID/method lookup; loaded once per
  redeploy, invalidated by DeploymentManagerActor after HandleDeployArtifacts applies
  external-system changes. Static JsonSerializerOptions for method-list parsing.
- Inbound API: short-TTL ApiMethodCache fronts the per-request ApiMethod repository
  fetch; invalidated by name via the existing ScriptArtifactChangeSubscriber/
  IScriptArtifactChangeBus pipeline, self-healing via TTL for changes the bus
  doesn't cover (e.g. Management API edits).
- StoreAndForward: the cached-call audit-observer queue — the one unbounded channel
  left in the system — is now bounded (ObserverQueueCapacity, default 10,000) with
  DropOldest overflow and a dropped-notification counter.
- SiteStreamManager: alarm state changes now travel a dedicated publish
  source/broadcast hub, isolated from the (far higher-volume) attribute path, so an
  attribute storm can no longer evict a pending alarm transition; the alarm hand-off
  queue is bounded with a drop counter surfaced on the site health report
  (SiteStreamAlarmDropCount via the new SiteStreamAlarmDropReporter), and publishing
  is skipped entirely at zero subscribers on either path.
- CLI ManagementHttpClient: explicit 30s HttpClient.Timeout on the shared
  construction (was the 100s framework default), overridable via
  SCADABRIDGE_HTTP_TIMEOUT_SECONDS.

Deviation: the failback-probe heartbeat item is NOT included — its only viable
surface (CentralChannelProvider.cs / heartbeat consumers) lives entirely in the
Communication project, explicitly off-limits to this work package this phase.

Tests: SiteRuntime.Tests (550), InboundAPI.Tests (278), StoreAndForward.Tests (133),
CLI.Tests (390), HealthMonitoring.Tests (97) — all green after full solution build.

tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ScriptArtifactChangeSubscriberTests.cs

@@ -41,12 +41,13 @@ public class ScriptArtifactChangeSubscriberTests
 
     private readonly InboundScriptExecutor _executor = new(
         NullLogger<InboundScriptExecutor>.Instance, Substitute.For<IServiceProvider>());
+    private readonly ApiMethodCache _methodCache = new(TimeSpan.FromMinutes(5));
     private readonly RecordingBus _bus = new();
     private readonly RouteHelper _route = new(
         Substitute.For<IInstanceLocator>(), Substitute.For<IInstanceRouter>());
 
     private ScriptArtifactChangeSubscriber CreateSubscriber(IScriptArtifactChangeBus? bus) =>
-        new(_executor, NullLogger<ScriptArtifactChangeSubscriber>.Instance, bus);
+        new(_executor, _methodCache, NullLogger<ScriptArtifactChangeSubscriber>.Instance, bus);
 
     private Task<InboundScriptResult> Run(ApiMethod m) => _executor.ExecuteAsync(
         m, new Dictionary<string, object?>(), _route, TimeSpan.FromSeconds(10));
@@ -121,6 +122,34 @@ public class ScriptArtifactChangeSubscriberTests
         Assert.Equal(0, _bus.SubscriberCount);
     }
 
+    /// <summary>
+    /// WP2.6b: an ApiMethod change notification must also drop the resolved-row cache
+    /// entry (not just the compiled handler) — proving EndpointExtensions' next lookup
+    /// re-fetches instead of serving a stale cached row for the rest of the TTL window.
+    /// </summary>
+    [Fact]
+    public async Task ApiMethodPublish_InvalidatesResolvedMethodCache()
+    {
+        var subscriber = CreateSubscriber(_bus);
+        await subscriber.StartAsync(CancellationToken.None);
+
+        var fetchCount = 0;
+        Task<ApiMethod?> Fetch(CancellationToken _)
+        {
+            fetchCount++;
+            return Task.FromResult<ApiMethod?>(new ApiMethod("m", "return 1;") { Id = 1 });
+        }
+
+        await _methodCache.GetOrFetchAsync("m", Fetch, CancellationToken.None);
+        await _methodCache.GetOrFetchAsync("m", Fetch, CancellationToken.None);
+        Assert.Equal(1, fetchCount); // second call served from cache
+
+        _bus.Publish(ApiMethodChanged("m"));
+
+        await _methodCache.GetOrFetchAsync("m", Fetch, CancellationToken.None);
+        Assert.Equal(2, fetchCount); // cache entry was dropped — re-fetched
+    }
+
     [Fact]
     public async Task NullBus_NoOps()
     {