feat(management): parquet audit export and audit archive list/verify (ScadaBridge#42)

GET /api/audit/export?format=parquet returned 501. It now streams the same 24
columns as csv/jsonl (AuditExportRow, CsvHeader order) as one Parquet file,
one 10,000-row row group at a time. Each row group is encoded into a small
non-seekable staging buffer and copied to the response asynchronously, because
Kestrel rejects the synchronous writes the Parquet writer issues.

New management commands, with CLI parity:
- ListAuditArchives -> `audit archive list` (AuditArchiveListResult: enabled
  flag + every manifest).
- VerifyAuditArchive(Name) -> `audit archive verify --name` (files, chain,
  purge anchor); exit 0 verified, 3 not verified, 1 error, 2 unauthorized.
Both carry verify-chain's gate: OperationalAudit roles (Administrator, Viewer),
site-scoped non-Administrator refused because an archive spans every site.
VerifyAuditArchive uses the long-running Ask timeout. Error codes
ARCHIVE_NOT_CONFIGURED, INVALID_ARGUMENT, NOT_FOUND.

RequiredRoleMatrixTests freezes both gates; ManagementSurfaceParityTests now
probes `audit archive list|verify` alongside `audit verify-chain`.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/CommandTreeTests.cs

@@ -69,7 +69,7 @@ public class CommandTreeTests
         Assert.Contains("bundle", groupNames);
     }
 
-    /// <summary>Verifies that the audit command group exposes the query, export and verify-chain subcommands.</summary>
+    /// <summary>Verifies that the audit command group exposes the query, export, verify-chain and archive subcommands.</summary>
     [Fact]
     public void AuditCommandGroup_HasQueryExportAndVerifyChain()
     {
@@ -80,6 +80,7 @@ public class CommandTreeTests
         Assert.Contains("query", subNames);
         Assert.Contains("export", subNames);
         Assert.Contains("verify-chain", subNames);
+        Assert.Contains("archive", subNames);
     }
 
     /// <summary>Verifies that the bundle command group exposes the export, preview and import subcommands.</summary>