fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/EventLogQueryServiceTests.cs

@@ -213,6 +213,42 @@ public class EventLogQueryServiceTests : IDisposable
         Assert.Equal(2, response.Entries.Count);
     }
 
+    [Fact]
+    public async Task Query_FiltersByTimeRange_HandlesNonUtcOffset()
+    {
+        // SiteEventLogging-024 (re-opens -016): the store holds UTC ISO-8601 "o"
+        // strings (always +00:00) and compares them lexicographically. If the
+        // From/To bounds are stringified verbatim without UTC normalisation, a
+        // non-UTC DateTimeOffset from a central client sorts wrongly against the
+        // stored +00:00 values and the wrong rows are returned. This test seeds
+        // events at known UTC instants and queries with bounds expressed in a
+        // +05:00 offset that bracket the middle row; it FAILS against the unfixed
+        // code (verbatim ToString("o")) and PASSES once From/To are normalised with
+        // .ToUniversalTime().
+
+        // Three events at distinct, well-separated UTC instants. The recorder always
+        // stores UTC, so seed the rows as UTC to mirror real data.
+        var baseUtc = new DateTimeOffset(2026, 6, 1, 12, 0, 0, TimeSpan.Zero);
+        InsertEventAt(baseUtc.AddHours(-2), "script", "Info", null, "EARLY", "Early event");   // 10:00 UTC
+        InsertEventAt(baseUtc, "script", "Info", null, "MIDDLE", "Middle event");              // 12:00 UTC
+        InsertEventAt(baseUtc.AddHours(2), "script", "Info", null, "LATE", "Late event");      // 14:00 UTC
+
+        // Express the SAME wall-clock window the operator intends — 11:00..13:00 UTC —
+        // but as a +05:00 DateTimeOffset (16:00..18:00 local). These bound only the
+        // MIDDLE row. With the bug, ToString("o") emits "...+05:00" which compares
+        // wrongly against the stored "...+00:00" rows.
+        var offset = TimeSpan.FromHours(5);
+        var fromNonUtc = new DateTimeOffset(2026, 6, 1, 16, 0, 0, offset); // == 11:00 UTC
+        var toNonUtc = new DateTimeOffset(2026, 6, 1, 18, 0, 0, offset);   // == 13:00 UTC
+
+        var response = _queryService.ExecuteQuery(MakeRequest(from: fromNonUtc, to: toNonUtc));
+
+        Assert.True(response.Success);
+        // Assert on row IDENTITIES, not just the count: only the MIDDLE row falls in
+        // the 11:00..13:00 UTC window.
+        Assert.Equal(new[] { "MIDDLE" }, response.Entries.Select(e => e.Source).ToArray());
+    }
+
     [Fact]
     public async Task Query_EmptyResult_WhenNoMatches()
     {