feat(audit): archive retention and superseded stale-archive cleanup (ScadaBridge#109)

Owner decisions recorded: the archive destination stays a directory/UNC
(no object-storage client; share + permissions named at enablement),
parquet-tools-only reading (no re-import), unsigned like the chain (#107).

AuditLog:Archive:RetentionDays (default 0 = never delete; else must exceed
AuditLog:RetentionDays, counted from the archived month's end) and
DeleteSupersededStaleArchives (default true) run after every purge tick.
A retried purge's stale Archived archive is deleted only when a later,
verifying, Purged archive of the same partition provably holds every row:
same prior anchor and the stale chain-end hash at its chain-end sequence
(row or tombstone), every unchained row present by EventId; otherwise it is
reported KeptStale. A sole copy left at Archived is never touched. Deletion
removes only the archive name's own three files in its folder, manifest
first, never a manifest-supplied path. `audit archive cleanup [--dry-run]`
= CleanupAuditArchives (Administrator).

AuditLogArchiveCleanupTests (MSSQL) cover retried purge, kept stale copy,
sole copy, retention and the path guard; each safety rule mutation-checked.
Follow-ups filed: #113, #114, #115.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -398,6 +398,8 @@ public class ManagementActor : ReceiveActor
         // AuditLog Parquet archives (ScadaBridge#42): audit reads with verify-chain's gate —
         // OperationalAudit roles, site-scoped callers refused in the handler.
         ListAuditArchivesCommand => OperationalAuditReaders,
+        // Archive cleanup deletes archive files (ScadaBridge#109): Administrator only.
+        CleanupAuditArchivesCommand => AdminOnly,
         VerifyAuditArchiveCommand => OperationalAuditReaders,
 
         // Read-only queries -- any authenticated user
@@ -574,6 +576,7 @@ public class ManagementActor : ReceiveActor
             VerifyAuditChainHeadsCommand cmd => await HandleVerifyAuditChainHeads(sp, cmd, user),
             ListAuditArchivesCommand => await HandleListAuditArchives(sp, user),
             VerifyAuditArchiveCommand cmd => await HandleVerifyAuditArchive(sp, cmd, user),
+            CleanupAuditArchivesCommand cmd => await HandleCleanupAuditArchives(sp, cmd, user),
 
             // Health
             GetHealthSummaryCommand => HandleGetHealthSummary(sp),
@@ -3340,6 +3343,20 @@ public class ManagementActor : ReceiveActor
         }
     }
 
+    /// <summary>
+    /// Runs the archive cleanup now (ScadaBridge#109), on the maintenance-connection archive when
+    /// registered. Dry run reports only.
+    /// </summary>
+    private static async Task<object?> HandleCleanupAuditArchives(
+        IServiceProvider sp, CleanupAuditArchivesCommand cmd, AuthenticatedUser user)
+    {
+        RequireAuditArchive(sp, user);
+        var archive = sp.GetKeyedService<IAuditLogArchive>(
+                ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Maintenance.AuditMaintenanceContext.ServiceKey)
+            ?? sp.GetRequiredService<IAuditLogArchive>();
+        return await archive.CleanupAsync(cmd.DryRun);
+    }
+
     private static IAuditLogArchive RequireAuditArchive(IServiceProvider sp, AuthenticatedUser user)
     {
         if (user.PermittedSiteIds.Length > 0