feat(audit)!: ScadaBridge C3 — swap to canonical ZB.MOM.WW.Audit.AuditEvent across seams/emitters/DTO/redactor wiring; transitional 24-col storage shim (Task 2.5)

src/ZB.MOM.WW.ScadaBridge.InboundAPI/Middleware/AuditWriteMiddleware.cs

@@ -5,9 +5,10 @@ using System.Text.Json;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using ZB.MOM.WW.Audit;
 using ZB.MOM.WW.ScadaBridge.AuditLog.Configuration;
-using ZB.MOM.WW.ScadaBridge.Commons.Entities.Audit;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Audit;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
 
 namespace ZB.MOM.WW.ScadaBridge.InboundAPI.Middleware;
@@ -234,37 +235,34 @@ public sealed class AuditWriteMiddleware
                 userAgent = ctx.Request.Headers.UserAgent.ToString(),
             });
 
-            var evt = new AuditEvent
-            {
-                EventId = Guid.NewGuid(),
-                OccurredAtUtc = DateTime.UtcNow,
-                Channel = AuditChannel.ApiInbound,
-                Kind = kind,
+            var evt = ScadaBridgeAuditEventFactory.Create(
+                channel: AuditChannel.ApiInbound,
+                kind: kind,
+                status: status,
+                occurredAtUtc: DateTime.UtcNow,
+                actor: actor,
+                target: methodName,
                 // Audit Log #23: the per-request execution id minted ONCE at the
                 // start of the request (InvokeAsync) and stashed on
                 // HttpContext.Items. The same id is threaded onto a routed
                 // RouteToCallRequest.ParentExecutionId by the endpoint handler,
                 // so an inbound request and the site script it routes to share
                 // one correlation point. This inbound row stays top-level — its
-                // own ParentExecutionId is never set (see below).
-                ExecutionId = ResolveInboundExecutionId(ctx),
+                // own ParentExecutionId is never set.
+                executionId: ResolveInboundExecutionId(ctx),
                 // CorrelationId is purely the per-operation-lifecycle id; an
                 // inbound request is a one-shot from the audit row's
                 // perspective with no multi-row operation to correlate.
-                CorrelationId = null,
-                Actor = actor,
-                Target = methodName,
-                Status = status,
-                HttpStatus = statusCode,
-                DurationMs = (int)Math.Min(durationMs, int.MaxValue),
-                ErrorMessage = thrown?.Message,
-                RequestSummary = requestBody,
-                ResponseSummary = responseBody,
-                PayloadTruncated = payloadTruncated,
-                Extra = extra,
-                // Central direct-write — no site-local forwarding state.
-                ForwardState = null,
-            };
+                correlationId: null,
+                httpStatus: statusCode,
+                durationMs: (int)Math.Min(durationMs, int.MaxValue),
+                errorMessage: thrown?.Message,
+                requestSummary: requestBody,
+                responseSummary: responseBody,
+                payloadTruncated: payloadTruncated,
+                extra: extra);
+            // Central direct-write — no site-local forwarding state (not a
+            // canonical field).
 
             // InboundAPI-018: fire-and-forget the writer so the user-facing
             // response stays non-blocking (alog.md §13 — audit emission must