feat(management): parquet audit export and audit archive list/verify (ScadaBridge#42)

GET /api/audit/export?format=parquet returned 501. It now streams the same 24
columns as csv/jsonl (AuditExportRow, CsvHeader order) as one Parquet file,
one 10,000-row row group at a time. Each row group is encoded into a small
non-seekable staging buffer and copied to the response asynchronously, because
Kestrel rejects the synchronous writes the Parquet writer issues.

New management commands, with CLI parity:
- ListAuditArchives -> `audit archive list` (AuditArchiveListResult: enabled
  flag + every manifest).
- VerifyAuditArchive(Name) -> `audit archive verify --name` (files, chain,
  purge anchor); exit 0 verified, 3 not verified, 1 error, 2 unauthorized.
Both carry verify-chain's gate: OperationalAudit roles (Administrator, Viewer),
site-scoped non-Administrator refused because an archive spans every site.
VerifyAuditArchive uses the long-running Ask timeout. Error codes
ARCHIVE_NOT_CONFIGURED, INVALID_ARGUMENT, NOT_FOUND.

RequiredRoleMatrixTests freezes both gates; ManagementSurfaceParityTests now
probes `audit archive list|verify` alongside `audit verify-chain`.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditCommands.cs

@@ -9,7 +9,9 @@ namespace ZB.MOM.WW.ScadaBridge.CLI.Commands;
 /// the centralized append-only Audit Log via the REST endpoints
 /// (<c>GET /api/audit/query</c>, <c>GET /api/audit/export</c>,
 /// <c>GET /api/audit/tree</c>), plus <c>verify-chain</c>, which sends the
-/// <c>VerifyAuditChain</c> management command (hash-chain tamper evidence, ScadaBridge#41).
+/// <c>VerifyAuditChain</c> management command (hash-chain tamper evidence, ScadaBridge#41),
+/// and <c>archive list</c> / <c>archive verify</c>, which send <c>ListAuditArchives</c> /
+/// <c>VerifyAuditArchive</c> (Parquet cold archive, ScadaBridge#42).
 /// </summary>
 public static class AuditCommands
 {
@@ -31,6 +33,7 @@ public static class AuditCommands
         command.Add(BuildTree(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildVerifyChain(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildBackfillSourceNode(urlOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildArchive(urlOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
@@ -316,6 +319,49 @@ public static class AuditCommands
         return cmd;
     }
 
+    /// <summary>
+    /// Builds the <c>audit archive</c> group (ScadaBridge#42): <c>list</c> and <c>verify</c>
+    /// over the AuditLog Parquet cold archives on the central archive directory.
+    /// </summary>
+    private static Command BuildArchive(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
+    {
+        var group = new Command("archive") { Description = "List and verify the AuditLog Parquet cold archives" };
+
+        var list = new Command("list") { Description = "List the AuditLog Parquet archives written by the retention purge" };
+        list.SetAction(async (ParseResult result) =>
+        {
+            var format = AuditCommandHelpers.ResolveFormat(result, formatOption);
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, urlOption, formatOption, usernameOption, passwordOption,
+                new ListAuditArchivesCommand(),
+                onSuccess: json => AuditArchiveHelpers.RenderList(json, format, Console.Out));
+        });
+        group.Add(list);
+
+        var nameOption = new Option<string>("--name")
+        {
+            Description = "Archive name, as 'audit archive list' prints it (auditlog-YYYY-MM-yyyyMMddTHHmmssfffZ)",
+            Required = true,
+        };
+        var verify = new Command("verify")
+        {
+            Description = "Verify an archive's files, its hash chain and its purge anchor; exit 3 if it does not verify",
+        };
+        verify.Add(nameOption);
+        verify.SetAction(async (ParseResult result) =>
+        {
+            var format = AuditCommandHelpers.ResolveFormat(result, formatOption);
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, urlOption, formatOption, usernameOption, passwordOption,
+                new VerifyAuditArchiveCommand(result.GetValue(nameOption)!),
+                timeout: AuditArchiveHelpers.VerifyRequestTimeout,
+                onSuccess: json => AuditArchiveHelpers.RenderVerify(json, format, Console.Out));
+        });
+        group.Add(verify);
+
+        return group;
+    }
+
     /// <summary>
     /// Builds the <c>audit backfill-source-node</c> sub-command.
     /// Sets <c>SourceNode</c> on historical pre-feature rows whose <c>SourceNode IS NULL</c>