feat(audit): archive retention and superseded stale-archive cleanup (ScadaBridge#109)

Owner decisions recorded: the archive destination stays a directory/UNC
(no object-storage client; share + permissions named at enablement),
parquet-tools-only reading (no re-import), unsigned like the chain (#107).

AuditLog:Archive:RetentionDays (default 0 = never delete; else must exceed
AuditLog:RetentionDays, counted from the archived month's end) and
DeleteSupersededStaleArchives (default true) run after every purge tick.
A retried purge's stale Archived archive is deleted only when a later,
verifying, Purged archive of the same partition provably holds every row:
same prior anchor and the stale chain-end hash at its chain-end sequence
(row or tombstone), every unchained row present by EventId; otherwise it is
reported KeptStale. A sole copy left at Archived is never touched. Deletion
removes only the archive name's own three files in its folder, manifest
first, never a manifest-supplied path. `audit archive cleanup [--dry-run]`
= CleanupAuditArchives (Administrator).

AuditLogArchiveCleanupTests (MSSQL) cover retried purge, kept stale copy,
sole copy, retention and the path guard; each safety rule mutation-checked.
Follow-ups filed: #113, #114, #115.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/AuditArchiveCommandTests.cs

@@ -144,4 +144,43 @@ public class AuditArchiveCommandTests : TestKit
         Assert.Equal(TimeSpan.FromMinutes(5),
             ManagementEndpoints.ResolveAskTimeout(new ManagementServiceOptions(), typeof(VerifyAuditArchiveCommand)));
     }
+
+    /// <summary>ScadaBridge#109: an Administrator runs the cleanup; the dry-run flag reaches the archive.</summary>
+    /// <param name="dryRun">The flag.</param>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public void Administrator_RunsCleanup_WithTheDryRunFlag(bool dryRun)
+    {
+        _archive.CleanupAsync(dryRun, Arg.Any<CancellationToken>()).Returns(new AuditArchiveCleanupResult(dryRun, 0,
+            [new AuditArchiveCleanupItem(Name, "2025-10", AuditArchiveCleanupAction.DeletedSuperseded, "superseded")]));
+
+        CreateActor().Tell(Envelope(new CleanupAuditArchivesCommand(dryRun), [], "Administrator"));
+
+        var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+        using var json = JsonDocument.Parse(response.JsonData);
+        Assert.Equal(dryRun, json.RootElement.GetProperty("dryRun").GetBoolean());
+        Assert.Equal("DeletedSuperseded", json.RootElement.GetProperty("items")[0].GetProperty("action").GetString());
+        _archive.Received(1).CleanupAsync(dryRun, Arg.Any<CancellationToken>());
+    }
+
+    /// <summary>Cleanup deletes files: a Viewer (audit reader) is refused.</summary>
+    [Fact]
+    public void Viewer_CannotRunCleanup()
+    {
+        CreateActor().Tell(Envelope(new CleanupAuditArchivesCommand(true), [], "Viewer"));
+
+        ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
+        _archive.DidNotReceiveWithAnyArgs().CleanupAsync(default, default);
+    }
+
+    /// <summary>No archive directory configured: ARCHIVE_NOT_CONFIGURED, as for list/verify.</summary>
+    [Fact]
+    public void Cleanup_WithoutAnArchiveDirectory_IsNotConfigured()
+    {
+        _archive.IsConfigured.Returns(false);
+        CreateActor().Tell(Envelope(new CleanupAuditArchivesCommand(true), [], "Administrator"));
+
+        Assert.Equal("ARCHIVE_NOT_CONFIGURED", ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5)).ErrorCode);
+    }
 }

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/RequiredRoleMatrixTests.cs

@@ -176,6 +176,8 @@ public class RequiredRoleMatrixTests
         // AuditLog Parquet archives (ScadaBridge#42): same audit-read gate as verify-chain.
         ["ListAuditArchives"] = [Roles.Administrator, Roles.Viewer],
         ["VerifyAuditArchive"] = [Roles.Administrator, Roles.Viewer],
+        // Archive cleanup deletes files (ScadaBridge#109): Administrator only.
+        ["CleanupAuditArchives"] = [Roles.Administrator],
 
         // ---- Two-person secured write ----------------------------------------------
         ["SubmitSecuredWrite"] = [Roles.Operator],