feat(audit): persist OPC UA certificate-trust decisions to the central audit log (ScadaBridge#43)

New AuditChannel.Security with AuditKind.CertTrust / CertTrustRemove (appended, ordinals stable).
Both central entry points - the management actor handlers and the Central UI CertManagementService -
write a best-effort ICentralAuditWriter row after the site outcome is known (Delivered when all
reachable site nodes acked, Failed otherwise, incl. relay timeouts), naming actor, site, thumbprint
and connection. Shared builder: CertTrustAuditEvents.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/CertTrustCommands.cs

@@ -12,6 +12,11 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 // singleton (active node only). For trust/remove it broadcasts the
 // corresponding per-node internal message to the per-node CertStoreActor on
 // EVERY site cluster node; for list it answers from the local node.
+//
+// The decision itself IS recorded centrally (Gitea #43): both central entry points (the
+// management actor and the Central UI CertManagementService) write an AuditChannel.Security
+// AuditLog row (AuditKind.CertTrust / CertTrustRemove) naming the actor, site and thumbprint,
+// with Delivered/Failed per the aggregate site outcome. Only the certificate itself stays site-local.
 // ─────────────────────────────────────────────────────────────────────────────
 
 /// <summary>