fix(security): close auth & site-scoping gaps across 8 findings

Resolves the auth-theme batch from the 2026-05-28 baseline review (8 findings
across Security/CentralUI/ManagementService/CLI). The most consequential gaps:
NotificationReport + SiteCallsReport now route through SiteScopeService so a
site-scoped Deployment user cannot see or act on other sites' rows (CUI-028);
QueryAuditLogCommand is no longer "any authenticated user" — gated Admin-only
to match /api/audit/query's strictness (MS-018); RoleMapper preserves the
broader grant when a user is in both an unscoped and scoped Deployment LDAP
group, instead of silently narrowing to the scoped set (Sec-016); and the
dead SiteScopeRequirement/Handler are deleted so SiteScopeService is
unambiguously the sole site-scoping mechanism (Sec-017). Pending findings:
172 → 164.

tests/ScadaLink.CLI.Tests/Commands/AuditExportCommandTests.cs

@@ -212,6 +212,58 @@ public class AuditExportCommandTests
         }
     }
 
+    [Fact]
+    public async Task RunExport_Http403_ReturnsExitCode2()
+    {
+        // CLI-018: an HTTP 403 on /api/audit/export must produce exit code 2 per the
+        // documented CLI contract — the legacy bare-1 return masked auth failures
+        // as generic command failures.
+        var path = Path.Combine(Path.GetTempPath(), $"audit-export-403-{Guid.NewGuid():N}.csv");
+        try
+        {
+            var handler = new BodyHandler(HttpStatusCode.Forbidden,
+                () => new StringContent("{\"error\":\"nope\",\"code\":\"UNAUTHORIZED\"}", Encoding.UTF8, "application/json"));
+            var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+            var output = new StringWriter();
+
+            var exit = await AuditExportHelpers.RunExportAsync(
+                client,
+                new AuditExportArgs { Since = "1h", Until = "0h", Format = "csv", Output = path },
+                output, DateTimeOffset.UtcNow);
+
+            Assert.Equal(2, exit);
+            Assert.False(File.Exists(path));
+        }
+        finally
+        {
+            if (File.Exists(path)) File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public async Task RunExport_UnauthorizedCodeOnNon403_ReturnsExitCode2()
+    {
+        var path = Path.Combine(Path.GetTempPath(), $"audit-export-401-{Guid.NewGuid():N}.csv");
+        try
+        {
+            var handler = new BodyHandler(HttpStatusCode.BadRequest,
+                () => new StringContent("{\"error\":\"nope\",\"code\":\"FORBIDDEN\"}", Encoding.UTF8, "application/json"));
+            var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+            var output = new StringWriter();
+
+            var exit = await AuditExportHelpers.RunExportAsync(
+                client,
+                new AuditExportArgs { Since = "1h", Until = "0h", Format = "csv", Output = path },
+                output, DateTimeOffset.UtcNow);
+
+            Assert.Equal(2, exit);
+        }
+        finally
+        {
+            if (File.Exists(path)) File.Delete(path);
+        }
+    }
+
     [Fact]
     public async Task RunExport_Parquet501_PrintsServerMessageAndReturnsNonZero()
     {

tests/ScadaLink.CLI.Tests/Commands/AuditQueryCommandTests.cs

@@ -281,6 +281,55 @@ public class AuditQueryCommandTests
         Assert.NotEqual(0, exit);
     }
 
+    [Fact]
+    public async Task RunQuery_Http403_ReturnsExitCode2()
+    {
+        // CLI-018: an authorization failure on /api/audit/query (HTTP 403) must
+        // produce exit code 2 per the documented CLI exit-code contract — the
+        // legacy bare-1 return masked auth failures as generic command failures.
+        var handler = new StatusHandler(HttpStatusCode.Forbidden, "{\"error\":\"nope\",\"code\":\"UNAUTHORIZED\"}");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditQueryHelpers.RunQueryAsync(
+            client, new AuditQueryArgs(), fetchAll: false,
+            new JsonLinesAuditFormatter(), output, DateTimeOffset.UtcNow);
+
+        Assert.Equal(2, exit);
+    }
+
+    [Fact]
+    public async Task RunQuery_UnauthorizedCodeOnNon403_ReturnsExitCode2()
+    {
+        // The server may signal authorization failure via the error code on a
+        // non-403 status (e.g. 400 + code=UNAUTHORIZED). Honour both channels.
+        var handler = new StatusHandler(HttpStatusCode.BadRequest, "{\"error\":\"nope\",\"code\":\"UNAUTHORIZED\"}");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditQueryHelpers.RunQueryAsync(
+            client, new AuditQueryArgs(), fetchAll: false,
+            new JsonLinesAuditFormatter(), output, DateTimeOffset.UtcNow);
+
+        Assert.Equal(2, exit);
+    }
+
+    [Fact]
+    public async Task RunQuery_GenericServerError_ReturnsExitCode1()
+    {
+        // Authentication / internal errors (non-403, no auth code) must remain
+        // exit code 1 — exit 2 is reserved for authorization failures.
+        var handler = new StatusHandler(HttpStatusCode.InternalServerError, "{\"error\":\"boom\",\"code\":\"INTERNAL\"}");
+        var client = new ManagementHttpClient(new HttpClient(handler), "http://localhost:9001", "u", "p");
+        var output = new StringWriter();
+
+        var exit = await AuditQueryHelpers.RunQueryAsync(
+            client, new AuditQueryArgs(), fetchAll: false,
+            new JsonLinesAuditFormatter(), output, DateTimeOffset.UtcNow);
+
+        Assert.Equal(1, exit);
+    }
+
     private sealed class ErrorHandler : HttpMessageHandler
     {
         protected override Task<HttpResponseMessage> SendAsync(
@@ -291,6 +340,16 @@ public class AuditQueryCommandTests
             });
     }
 
+    private sealed class StatusHandler : HttpMessageHandler
+    {
+        private readonly HttpStatusCode _status;
+        private readonly string _body;
+        public StatusHandler(HttpStatusCode status, string body) { _status = status; _body = body; }
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request, CancellationToken cancellationToken)
+            => Task.FromResult(new HttpResponseMessage(_status) { Content = new StringContent(_body) });
+    }
+
     // ---- CLI parsing -------------------------------------------------------
 
     [Fact]