fix(security): close auth & site-scoping gaps across 8 findings

Resolves the auth-theme batch from the 2026-05-28 baseline review (8 findings
across Security/CentralUI/ManagementService/CLI). The most consequential gaps:
NotificationReport + SiteCallsReport now route through SiteScopeService so a
site-scoped Deployment user cannot see or act on other sites' rows (CUI-028);
QueryAuditLogCommand is no longer "any authenticated user" — gated Admin-only
to match /api/audit/query's strictness (MS-018); RoleMapper preserves the
broader grant when a user is in both an unscoped and scoped Deployment LDAP
group, instead of silently narrowing to the scoped set (Sec-016); and the
dead SiteScopeRequirement/Handler are deleted so SiteScopeService is
unambiguously the sole site-scoping mechanism (Sec-017). Pending findings:
172 → 164.

tests/ScadaLink.ManagementService.Tests/ManagementActorTests.cs

@@ -94,6 +94,36 @@ public class ManagementActorTests : TestKit, IDisposable
         Assert.Contains("Deployment", response.Message);
     }
 
+    [Fact]
+    public void QueryAuditLogCommand_WithNoRoles_ReturnsUnauthorized()
+    {
+        // ManagementService-018: QueryAuditLogCommand used to fall through to the
+        // default "any authenticated user" case, allowing a Deployment-only or
+        // no-role caller to read the configuration audit log via /management
+        // even though /api/audit/query enforces OperationalAuditRoles. The fix
+        // gates this legacy command to Admin so the older route is never looser
+        // than the new REST endpoint.
+        var actor = CreateActor();
+        var envelope = Envelope(new QueryAuditLogCommand(null, null, null, null, null, 1, 25));
+
+        actor.Tell(envelope);
+
+        var response = ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
+        Assert.Contains("Admin", response.Message);
+    }
+
+    [Fact]
+    public void QueryAuditLogCommand_WithDeploymentRole_ReturnsUnauthorized()
+    {
+        var actor = CreateActor();
+        var envelope = Envelope(new QueryAuditLogCommand(null, null, null, null, null, 1, 25), "Deployment");
+
+        actor.Tell(envelope);
+
+        var response = ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
+        Assert.Contains("Admin", response.Message);
+    }
+
     // ========================================================================
     // 2. Read-only query passes without special role
     // ========================================================================