feat(management): parquet audit export and audit archive list/verify (ScadaBridge#42)

GET /api/audit/export?format=parquet returned 501. It now streams the same 24
columns as csv/jsonl (AuditExportRow, CsvHeader order) as one Parquet file,
one 10,000-row row group at a time. Each row group is encoded into a small
non-seekable staging buffer and copied to the response asynchronously, because
Kestrel rejects the synchronous writes the Parquet writer issues.

New management commands, with CLI parity:
- ListAuditArchives -> `audit archive list` (AuditArchiveListResult: enabled
  flag + every manifest).
- VerifyAuditArchive(Name) -> `audit archive verify --name` (files, chain,
  purge anchor); exit 0 verified, 3 not verified, 1 error, 2 unauthorized.
Both carry verify-chain's gate: OperationalAudit roles (Administrator, Viewer),
site-scoped non-Administrator refused because an archive spans every site.
VerifyAuditArchive uses the long-running Ask timeout. Error codes
ARCHIVE_NOT_CONFIGURED, INVALID_ARGUMENT, NOT_FOUND.

RequiredRoleMatrixTests freezes both gates; ManagementSurfaceParityTests now
probes `audit archive list|verify` alongside `audit verify-chain`.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/RequiredRoleMatrixTests.cs

@@ -171,6 +171,9 @@ public class RequiredRoleMatrixTests
         // AuditLog hash-chain verification (ScadaBridge#41) carries audit query's
         // OperationalAudit permission (alog.md §15.1); written out by hand to keep the freeze.
         ["VerifyAuditChain"] = [Roles.Administrator, Roles.Viewer],
+        // AuditLog Parquet archives (ScadaBridge#42): same audit-read gate as verify-chain.
+        ["ListAuditArchives"] = [Roles.Administrator, Roles.Viewer],
+        ["VerifyAuditArchive"] = [Roles.Administrator, Roles.Viewer],
 
         // ---- Two-person secured write ----------------------------------------------
         ["SubmitSecuredWrite"] = [Roles.Operator],