fix(health): decouple AuditCentralHealthSnapshot from ActorSystem (#23 M6)

The snapshot's per-site stalled latch now lives on the snapshot itself
and is fed by SiteAuditTelemetryStalledTracker via ApplyStalled, removing
the chain that required ActorSystem at DI composition time. The tracker
is now constructed by AkkaHostedService once ActorSystem.Create returns,
with a lock-guarded auxiliary-disposable list so concurrent host
start/stop in tests cannot race the enumeration.

src/ScadaLink.AuditLog/Central/SiteAuditTelemetryStalledTracker.cs

@@ -46,6 +46,7 @@ public sealed class SiteAuditTelemetryStalledTracker : IDisposable
     private readonly EventStream _eventStream;
     private readonly ConcurrentDictionary<string, bool> _state = new();
     private readonly IActorRef? _subscriber;
+    private readonly AuditCentralHealthSnapshot? _snapshot;
     private bool _disposed;
 
     /// <summary>
@@ -67,12 +68,24 @@ public sealed class SiteAuditTelemetryStalledTracker : IDisposable
     /// via Akka.TestKit so they exercise the production subscribe path.
     /// </remarks>
     public SiteAuditTelemetryStalledTracker(EventStream eventStream)
+        : this(eventStream, snapshot: null)
+    {
+    }
+
+    /// <summary>
+    /// Bare-stream ctor with an optional snapshot sink — the central
+    /// composition root passes the singleton
+    /// <see cref="AuditCentralHealthSnapshot"/> so every dictionary update
+    /// also lands on the central health surface. The bare ctor still cannot
+    /// subscribe (no actor system), but tests that drive the tracker via
+    /// <see cref="Apply"/> get the snapshot push for free.
+    /// </summary>
+    public SiteAuditTelemetryStalledTracker(EventStream eventStream, AuditCentralHealthSnapshot? snapshot)
     {
         _eventStream = eventStream ?? throw new ArgumentNullException(nameof(eventStream));
-        // No subscriber actor — see the remarks above. Apply() is exposed
-        // internally so the ActorSystem ctor's internal forwarder can update
-        // state without re-implementing the dictionary write.
+        // No subscriber actor — see the remarks on the parameterless overload.
         _subscriber = null;
+        _snapshot = snapshot;
     }
 
     /// <summary>
@@ -82,9 +95,21 @@ public sealed class SiteAuditTelemetryStalledTracker : IDisposable
     /// per-site map. <see cref="Dispose"/> tears the subscriber down.
     /// </summary>
     public SiteAuditTelemetryStalledTracker(ActorSystem actorSystem)
+        : this(actorSystem, snapshot: null)
+    {
+    }
+
+    /// <summary>
+    /// Production ctor with a snapshot sink — every observed
+    /// <see cref="SiteAuditTelemetryStalledChanged"/> is mirrored onto the
+    /// shared <see cref="AuditCentralHealthSnapshot"/> so the central health
+    /// surface sees per-site stalled state without re-reading the tracker.
+    /// </summary>
+    public SiteAuditTelemetryStalledTracker(ActorSystem actorSystem, AuditCentralHealthSnapshot? snapshot)
     {
         ArgumentNullException.ThrowIfNull(actorSystem);
         _eventStream = actorSystem.EventStream;
+        _snapshot = snapshot;
         // Anonymous subscriber actor scoped to the system; props build it
         // with a callback into THIS tracker's Apply method so the actor's
         // single-threaded receive serialises every dictionary write.
@@ -115,6 +140,11 @@ public sealed class SiteAuditTelemetryStalledTracker : IDisposable
     {
         if (evt is null) return;
         _state[evt.SiteId] = evt.Stalled;
+        // Mirror into the central health snapshot if wired so a reader of
+        // IAuditCentralHealthSnapshot sees the same per-site state without
+        // a second lookup. Snapshot is optional (test composition roots may
+        // skip it) so the null-coalesce is the safe path.
+        _snapshot?.ApplyStalled(evt);
     }
 
     public void Dispose()