fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

tests/ZB.MOM.WW.ScadaBridge.Commons.Tests/Kpi/KpiSeriesBucketerTests.cs

@@ -183,6 +183,62 @@ public class KpiSeriesBucketerTests
         Assert.Equal(T(40), result[2].BucketStartUtc);
     }
 
+    // -----------------------------------------------------------------------
+    // Unsorted input: last-in-iteration wins within a bucket (NOT largest timestamp)
+    // -----------------------------------------------------------------------
+
+    [Fact]
+    public void Bucket_UnsortedInput_SelectsLastInIterationNotLargestTimestamp()
+    {
+        // KpiHistory-006 regression: pins the documented contract that for unsorted input the
+        // bucketer selects the LAST point in iteration order within a bucket — it does NOT pick
+        // the largest-timestamp point. Both points below fall in bucket 0 ([0, 30)); the later
+        // one in iteration order, T(5)=value 1.0, arrives second, so it overwrites T(20)=value
+        // 99.0 even though T(20) has the larger timestamp. (For ascending-sorted input these
+        // coincide — last-in-iteration IS largest timestamp — which is why production is safe.)
+        var raw = new[]
+        {
+            new KpiSeriesPoint(T(20), 99.0), // larger timestamp, but encountered FIRST
+            new KpiSeriesPoint(T(5),  1.0),  // smaller timestamp, but encountered LAST → wins
+            new KpiSeriesPoint(T(45), 7.0),  // bucket 1 ([30, 60])
+        };
+
+        // 60-minute window / 2 buckets → 30 min each. raw.Count (3) > maxPoints (2) → downsample.
+        var result = KpiSeriesBucketer.Bucket(raw, T(0), T(60), maxPoints: 2);
+
+        Assert.Equal(2, result.Count);
+        // Bucket 0: last-in-iteration (value 1.0) wins, NOT the largest-timestamp point (99.0).
+        Assert.Equal(1.0, result[0].Value);
+        Assert.Equal(7.0, result[1].Value);
+    }
+
+    // -----------------------------------------------------------------------
+    // Short series (raw.Count <= maxPoints): returned unchanged → raw capture timestamps
+    // -----------------------------------------------------------------------
+
+    [Fact]
+    public void Bucket_ShortSeries_ReturnsRawCaptureTimestampsNotBucketBoundaries()
+    {
+        // KpiHistory-005/003 regression: the short-series early-return path returns the input
+        // unchanged, so each output point's BucketStartUtc is the RAW capture timestamp — NOT a
+        // bucket-boundary timestamp (which is what the downsample path emits, asserted by
+        // Bucket_BucketStartUtc_IsSetToBucketStartNotRawPointTimestamp). This pins the
+        // intentional difference between the two return paths.
+        var raw = new[]
+        {
+            new KpiSeriesPoint(T(7),  1.0),
+            new KpiSeriesPoint(T(23), 2.0),
+        };
+
+        // raw.Count (2) <= maxPoints (5) → early return, same reference.
+        var result = KpiSeriesBucketer.Bucket(raw, T(0), T(60), maxPoints: 5);
+
+        Assert.Same(raw, result);
+        // Timestamps are the raw capture instants, not bucket starts (which would be T(0), T(12), …).
+        Assert.Equal(T(7),  result[0].BucketStartUtc);
+        Assert.Equal(T(23), result[1].BucketStartUtc);
+    }
+
     // -----------------------------------------------------------------------
     // Right-edge: point exactly at toUtc lands in the last bucket
     // -----------------------------------------------------------------------