feat(commons): additive SiteIdentifier on browse/verify/cert-trust commands for management-API routing (arch-review C4)

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/BrowseCommands.cs

@@ -21,10 +21,16 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 /// request carry back the token from the prior <see cref="BrowseNodeResult.ContinuationToken"/>.
 /// Additive (appended last) so positional construction stays source-compatible.
 /// </param>
+/// <param name="SiteIdentifier">
+/// Target site identifier — REQUIRED when the command is invoked via the management
+/// HTTP API/CLI (the actor must route it to a site); ignored on the site side, where
+/// routing already happened. Additive per the message-contract evolution rules.
+/// </param>
 public record BrowseNodeCommand(
     string ConnectionName,
     string? ParentNodeId,
-    string? ContinuationToken = null);
+    string? ContinuationToken = null,
+    string? SiteIdentifier = null);
 
 /// <param name="Children">Immediate children resolved for the browsed node (this page only).</param>
 /// <param name="Truncated">True when the result was clipped (frame-budget cap or adapter-reported truncation).</param>
@@ -59,11 +65,17 @@ public record BrowseNodeResult(
 /// <param name="Query">Case-insensitive substring matched against each node's DisplayName and root-relative path.</param>
 /// <param name="MaxDepth">Maximum number of levels below the root to descend. Must be non-negative.</param>
 /// <param name="MaxResults">Maximum number of matches to return; when reached the walk stops early and <see cref="SearchAddressSpaceResult.CapReached"/> is set.</param>
+/// <param name="SiteIdentifier">
+/// Target site identifier — REQUIRED when the command is invoked via the management
+/// HTTP API/CLI (the actor must route it to a site); ignored on the site side, where
+/// routing already happened. Additive per the message-contract evolution rules.
+/// </param>
 public record SearchAddressSpaceCommand(
     string ConnectionName,
     string Query,
     int MaxDepth,
-    int MaxResults);
+    int MaxResults,
+    string? SiteIdentifier = null);
 
 /// <param name="Matches">The matched address-space nodes, in breadth-first discovery order (capped at <see cref="SearchAddressSpaceCommand.MaxResults"/>).</param>
 /// <param name="CapReached">True when a bound (result cap or the adapter's node-visit ceiling) cut the walk short, so more matches may exist than were returned.</param>

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/CertTrustCommands.cs

@@ -22,21 +22,36 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 /// <param name="ConnectionName">The data-connection the certificate was captured from (diagnostics / correlation only).</param>
 /// <param name="DerBase64">The server certificate's DER encoding, base64-encoded.</param>
 /// <param name="Thumbprint">The certificate thumbprint — used as the store filename key.</param>
-public record TrustServerCertCommand(string ConnectionName, string DerBase64, string Thumbprint);
+/// <param name="SiteIdentifier">
+/// Target site identifier — REQUIRED when the command is invoked via the management
+/// HTTP API/CLI (the actor must route it to a site); ignored on the site side, where
+/// routing already happened. Additive per the message-contract evolution rules.
+/// </param>
+public record TrustServerCertCommand(string ConnectionName, string DerBase64, string Thumbprint, string? SiteIdentifier = null);
 
 /// <summary>
 /// Remove a previously-trusted OPC UA server certificate from every site
 /// node's trusted-peer PKI store, identified by thumbprint.
 /// </summary>
 /// <param name="Thumbprint">The thumbprint of the certificate to remove.</param>
-public record RemoveServerCertCommand(string Thumbprint);
+/// <param name="SiteIdentifier">
+/// Target site identifier — REQUIRED when the command is invoked via the management
+/// HTTP API/CLI (the actor must route it to a site); ignored on the site side, where
+/// routing already happened. Additive per the message-contract evolution rules.
+/// </param>
+public record RemoveServerCertCommand(string Thumbprint, string? SiteIdentifier = null);
 
 /// <summary>
 /// List the certificates currently present in this site's trusted-peer and
 /// rejected PKI stores. Answered from the local node (the Deployment Manager
 /// singleton's own node).
 /// </summary>
-public record ListServerCertsCommand();
+/// <param name="SiteIdentifier">
+/// Target site identifier — REQUIRED when the command is invoked via the management
+/// HTTP API/CLI (the actor must route it to a site); ignored on the site side, where
+/// routing already happened. Additive per the message-contract evolution rules.
+/// </param>
+public record ListServerCertsCommand(string? SiteIdentifier = null);
 
 /// <summary>
 /// Read-only projection of a certificate found in a site PKI store.

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Management/VerifyEndpointCommands.cs

@@ -12,7 +12,12 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 /// <param name="ConnectionName">Name of the data connection being verified (for logging/correlation).</param>
 /// <param name="Protocol">Protocol type string (e.g. "OpcUa"); matched case-insensitively.</param>
 /// <param name="ConfigJson">Serialized endpoint configuration JSON (the typed OPC UA endpoint shape).</param>
-public record VerifyEndpointCommand(string ConnectionName, string Protocol, string ConfigJson);
+/// <param name="SiteIdentifier">
+/// Target site identifier — REQUIRED when the command is invoked via the management
+/// HTTP API/CLI (the actor must route it to a site); ignored on the site side, where
+/// routing already happened. Additive per the message-contract evolution rules.
+/// </param>
+public record VerifyEndpointCommand(string ConnectionName, string Protocol, string ConfigJson, string? SiteIdentifier = null);
 
 /// <summary>
 /// Classification of why an endpoint verification failed. Distinguishes the cases the