feat(audit): SHA-256 hash chain over the central AuditLog (ScadaBridge#41)

Audit roadmap T1 (alog.md §11.4): one chain per UTC calendar month of
OccurredAtUtc. Each chained row carries ChainSeq (gap-free within its month)
and RowHash = SHA-256(prev.RowHash || canonical(row)); the v1 canonical form
(AuditChainHasher) is pinned by a known-answer vector computed independently.

- Migration AddAuditLogHashChain: nullable ChainSeq/RowHash on dbo.AuditLog
  (metadata-only add), AuditLogChainHead (per-month chain end + partition-purge
  checkpoint anchor), AuditLogChainTombstone, two partition-aligned filtered
  indexes, scadabridge_audit_chainer role with a column-level UPDATE grant.
  Production script docs/plans/sql/AddAuditLogHashChain.sql.
- AuditLogHashChain chains unchained rows oldest month first under an
  exclusive sp_getapplock (zero timeout, so a dual-active central pair still
  yields one chain), with an optimistic head check and a ChainSeq IS NULL
  row-count check that roll a pass back instead of leaving a gap. The ingest
  path is untouched.
- Purges keep the chain verifiable: the partition switch records the month's
  checkpoint anchor and drops its tombstones; the per-channel DELETE writes a
  tombstone per chained row in the same transaction (OUTPUT INTO). Both, and
  the SourceNode backfill, hold the chain lock; the backfill skips chained
  rows. The switch staging table gains the two new columns.
- AuditChainVerifier reports the first break (partition, ChainSeq, EventId,
  kind) for edited, deleted, reordered rows and tail truncation.
- AuditLogHashChainService (central, default OFF via AuditLog:HashChain).

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/ZB.MOM.WW.ScadaBridge.AuditLog/ServiceCollectionExtensions.cs

@@ -52,6 +52,9 @@ public static class ServiceCollectionExtensions
     /// <summary>Configuration section bound to <see cref="AuditLogPartitionMaintenanceOptions"/>.</summary>
     public const string PartitionMaintenanceSectionName = "AuditLog:PartitionMaintenance";
 
+    /// <summary>Configuration section bound to <see cref="AuditLogHashChainOptions"/> (ScadaBridge#41).</summary>
+    public const string HashChainSectionName = "AuditLog:HashChain";
+
     /// <summary>Configuration section bound to <see cref="ZB.MOM.WW.ScadaBridge.AuditLog.Central.AuditLogPurgeOptions"/>.</summary>
     public const string PurgeSectionName = "AuditLog:Purge";
 
@@ -395,6 +398,13 @@ public static class ServiceCollectionExtensions
             AuditLogPartitionMaintenanceOptionsValidator>(config, PartitionMaintenanceSectionName);
         services.AddHostedService<AuditLogPartitionMaintenanceService>();
 
+        // Hash-chain tamper evidence (ScadaBridge#41). Default OFF; the hosted service is
+        // always registered and returns from StartAsync without a loop when disabled.
+        // IAuditLogHashChain is registered by AddConfigurationDatabase (central only).
+        services.AddValidatedOptions<AuditLogHashChainOptions, AuditLogHashChainOptionsValidator>(
+            config, HashChainSectionName);
+        services.AddHostedService<AuditLogHashChainService>();
+
         // I1 (review): bind the two central-singleton options HERE rather than in
         // AddAuditLogCentralReconciliationClient. AkkaHostedService.RegisterCentralActors
         // resolves IOptions<AuditLogPurgeOptions> / <SiteAuditReconciliationOptions>