fix(esg): JSON-serialise non-scalar GET/DELETE query parameters (review 2026-10-21 05/O2)

src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ExternalSystemClient.cs

@@ -614,7 +614,7 @@ public class ExternalSystemClient : IExternalSystemClient
             var consumed = consumedParams;
             var queryString = string.Join("&",
                 parameters.Where(p => p.Value != null && !consumed.Contains(p.Key))
-                    .Select(p => $"{Uri.EscapeDataString(p.Key)}={Uri.EscapeDataString(p.Value?.ToString() ?? "")}"));
+                    .Select(p => $"{Uri.EscapeDataString(p.Key)}={Uri.EscapeDataString(FormatQueryValue(p.Value))}"));
 
             // Only append "?" when the effective query string is non-empty — a method
             // whose parameter values are all null produces no query string, and the
@@ -629,6 +629,31 @@ public class ExternalSystemClient : IExternalSystemClient
         return url;
     }
 
+    /// <summary>
+    /// Renders a GET/DELETE query-string value. Scalars use <c>ToString()</c>; collections,
+    /// dictionaries and other complex objects are JSON-serialised (as the POST/PUT/PATCH
+    /// branch already does) instead of degrading to a CLR type name such as
+    /// <c>System.Int32[]</c> (review 2026-10-21 05/O2).
+    /// </summary>
+    internal static string FormatQueryValue(object? value)
+    {
+        switch (value)
+        {
+            case null:
+                return string.Empty;
+            case string or char or bool or Guid or Uri or DateTime or DateTimeOffset or TimeSpan or Enum or decimal:
+                return value.ToString() ?? string.Empty;
+            case JsonElement { ValueKind: JsonValueKind.Object or JsonValueKind.Array } json:
+                return json.GetRawText();
+            case JsonElement scalar:
+                return scalar.ToString();
+        }
+
+        return value.GetType().IsPrimitive
+            ? value.ToString() ?? string.Empty
+            : JsonSerializer.Serialize(value);
+    }
+
     private void ApplyAuth(HttpRequestMessage request, ExternalSystemDefinition system)
     {
         // Distinguish "intentionally unauthenticated" (AuthType = none)