fix(adminui): wire Test Connect probes + live panels on admin-only nodes

Both bugs surfaced only on split-role deployments (the MAIN cluster's
admin-only nodes), where the AdminUI runs without the driver role.

- Test Connect returned "No probe registered" for every driver: the
  IDriverProbe set was registered only under the driver role, but the
  admin-operations singleton that consumes it is pinned to admin. Extract
  AddOtOpcUaDriverProbes() (idempotent via TryAddEnumerable) and call it
  in the hasAdmin path too.

- Live driver-status/alerts/script-log panels showed "SignalR error:
  Connection refused": these Blazor Server components opened a HubConnection
  to their own hub via the browser's public URL, which server-side code
  can't reach behind Traefik (host :9200 -> container :9000). Read the
  in-process source directly instead -- DriverStatus via
  IDriverStatusSnapshotStore.SnapshotChanged, Alerts/ScriptLog via a new
  IInProcessBroadcaster<T>. Fleet status was unaffected (reads DB/ActorSystem).

Adds unit tests for probe registration, the snapshot-store event, and the
broadcaster.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/AlertSignalRBridge.cs

@@ -17,22 +17,26 @@ public sealed class AlertSignalRBridge : ReceiveActor
     public const string TopicName = "alerts";
 
     private readonly IHubContext<AlertHub> _hub;
+    private readonly IInProcessBroadcaster<AlarmTransitionEvent> _broadcaster;
     private readonly ILoggingAdapter _log = Context.GetLogger();
 
     /// <summary>
     /// Creates actor props for the AlertSignalRBridge.
     /// </summary>
     /// <param name="hub">The SignalR hub context to send alerts to.</param>
-    public static Props Props(IHubContext<AlertHub> hub) =>
-        Akka.Actor.Props.Create(() => new AlertSignalRBridge(hub));
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Alerts page.</param>
+    public static Props Props(IHubContext<AlertHub> hub, IInProcessBroadcaster<AlarmTransitionEvent> broadcaster) =>
+        Akka.Actor.Props.Create(() => new AlertSignalRBridge(hub, broadcaster));
 
     /// <summary>
     /// Initializes a new instance of the AlertSignalRBridge actor.
     /// </summary>
     /// <param name="hub">The SignalR hub context to send alerts to.</param>
-    public AlertSignalRBridge(IHubContext<AlertHub> hub)
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Alerts page.</param>
+    public AlertSignalRBridge(IHubContext<AlertHub> hub, IInProcessBroadcaster<AlarmTransitionEvent> broadcaster)
     {
         _hub = hub;
+        _broadcaster = broadcaster;
         ReceiveAsync<AlarmTransitionEvent>(ForwardAsync);
         Receive<SubscribeAck>(_ => { /* DPS confirmation */ });
     }
@@ -43,6 +47,9 @@ public sealed class AlertSignalRBridge : ReceiveActor
 
     private async Task ForwardAsync(AlarmTransitionEvent msg)
     {
+        // In-process fan-out first — this is what the Blazor Server Alerts page reads. The hub push
+        // is kept for any out-of-process (e.g. WASM) SignalR client.
+        _broadcaster.Publish(msg);
         try
         {
             await _hub.Clients.All.SendAsync(AlertHub.MethodName, msg);

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/HubServiceCollectionExtensions.cs

@@ -13,14 +13,21 @@ public static class HubServiceCollectionExtensions
     public const string DriverStatusSignalRBridgeName = "driver-status-signalr-bridge";
 
     /// <summary>
-    ///     Registers services required by the driver-status hub pipeline:
-    ///     <see cref="IDriverStatusSnapshotStore"/> as a singleton backed by
-    ///     <see cref="InMemoryDriverStatusSnapshotStore"/>.
+    ///     Registers the in-process live-push services the AdminUI's Blazor Server panels read
+    ///     directly (instead of self-connecting a SignalR <c>HubConnection</c>, which fails behind a
+    ///     reverse proxy — see <see cref="IInProcessBroadcaster{T}"/>):
+    ///     <list type="bullet">
+    ///       <item><see cref="IDriverStatusSnapshotStore"/> — last-value snapshot per driver.</item>
+    ///       <item><see cref="IInProcessBroadcaster{T}"/> — append-stream fan-out (alarm
+    ///       transitions, script-log lines). Registered as an open generic so each closed type
+    ///       resolves to its own singleton shared by the bridge actor and the consuming component.</item>
+    ///     </list>
     /// </summary>
     /// <param name="services">The service collection.</param>
     public static IServiceCollection AddOtOpcUaDriverStatusServices(this IServiceCollection services)
     {
         services.AddSingleton<IDriverStatusSnapshotStore, InMemoryDriverStatusSnapshotStore>();
+        services.AddSingleton(typeof(IInProcessBroadcaster<>), typeof(InProcessBroadcaster<>));
         return services;
     }
 
@@ -48,11 +55,13 @@ public static class HubServiceCollectionExtensions
             registry.Register<FleetStatusSignalRBridgeKey>(fleetBridge);
 
             var alertHub = resolver.GetService<IHubContext<AlertHub>>();
-            var alertBridge = system.ActorOf(AlertSignalRBridge.Props(alertHub), AlertSignalRBridgeName);
+            var alertBroadcaster = resolver.GetService<IInProcessBroadcaster<Commons.Messages.Alerts.AlarmTransitionEvent>>();
+            var alertBridge = system.ActorOf(AlertSignalRBridge.Props(alertHub, alertBroadcaster), AlertSignalRBridgeName);
             registry.Register<AlertSignalRBridgeKey>(alertBridge);
 
             var scriptLogHub = resolver.GetService<IHubContext<ScriptLogHub>>();
-            var scriptLogBridge = system.ActorOf(ScriptLogSignalRBridge.Props(scriptLogHub), ScriptLogSignalRBridgeName);
+            var scriptLogBroadcaster = resolver.GetService<IInProcessBroadcaster<Commons.Messages.Logging.ScriptLogEntry>>();
+            var scriptLogBridge = system.ActorOf(ScriptLogSignalRBridge.Props(scriptLogHub, scriptLogBroadcaster), ScriptLogSignalRBridgeName);
             registry.Register<ScriptLogSignalRBridgeKey>(scriptLogBridge);
 
             var driverStatusHub = resolver.GetService<IHubContext<DriverStatusHub>>();

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/IDriverStatusSnapshotStore.cs

@@ -6,10 +6,21 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 ///     Singleton last-snapshot-per-instance cache. Populated by
 ///     <c>DriverStatusSignalRBridge</c> as it forwards DPS messages; read by
 ///     <see cref="DriverStatusHub.JoinDriver"/> so newly-joined clients see current state
-///     without waiting for the next change event.
+///     without waiting for the next change event, and subscribed to directly by the Blazor
+///     Server <c>DriverStatusPanel</c> via <see cref="SnapshotChanged"/>.
 /// </summary>
 public interface IDriverStatusSnapshotStore
 {
     void Upsert(DriverHealthChanged snapshot);
     bool TryGet(string driverInstanceId, out DriverHealthChanged snapshot);
+
+    /// <summary>
+    ///     Raised after every <see cref="Upsert"/> with the just-stored snapshot. Lets in-process
+    ///     consumers (the Blazor Server <c>DriverStatusPanel</c>) receive live updates by reading
+    ///     this singleton directly instead of opening a self-targeted SignalR connection — which a
+    ///     server-side Blazor component cannot reach when the public URL (e.g. a reverse-proxy port)
+    ///     differs from the local Kestrel bind. Handlers run on the caller's thread (the bridge
+    ///     actor), so subscribers must marshal to their own sync context.
+    /// </summary>
+    event Action<DriverHealthChanged>? SnapshotChanged;
 }

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/IInProcessBroadcaster.cs

@@ -0,0 +1,41 @@
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
+
+/// <summary>
+///     A singleton, in-process fan-out for live event streams (alarm transitions, script-log
+///     lines). A per-node SignalR bridge actor subscribes to the cluster's DistributedPubSub topic
+///     and calls <see cref="Publish"/>; Blazor Server components subscribe to <see cref="Received"/>
+///     to render the live tail.
+///     <para>
+///     This exists because the AdminUI runs as Blazor <em>Server</em>: a component opening a
+///     SignalR <c>HubConnection</c> to its own hub would dial the browser's public URL from
+///     server-side code, which is unreachable behind a reverse proxy (e.g. Traefik mapping host
+///     :9200 → container :9000) and so fails with "Connection refused". Reading this in-process
+///     broadcaster instead avoids the network hop entirely. Mirrors the
+///     <c>IDriverStatusSnapshotStore.SnapshotChanged</c> pattern for stream (vs. last-value) feeds.
+///     </para>
+/// </summary>
+/// <typeparam name="T">The event payload type (e.g. AlarmTransitionEvent, ScriptLogEntry).</typeparam>
+public interface IInProcessBroadcaster<T>
+{
+    /// <summary>
+    ///     Raised once per <see cref="Publish"/> with the published item. Handlers run on the
+    ///     caller's thread (the bridge actor), so subscribers must marshal to their own sync
+    ///     context (Blazor's <c>InvokeAsync</c>).
+    /// </summary>
+    event Action<T>? Received;
+
+    /// <summary>Fan the item out to all current <see cref="Received"/> subscribers.</summary>
+    void Publish(T item);
+}
+
+/// <summary>Thread-safe singleton implementation of <see cref="IInProcessBroadcaster{T}"/>.</summary>
+/// <typeparam name="T">The event payload type.</typeparam>
+public sealed class InProcessBroadcaster<T> : IInProcessBroadcaster<T>
+{
+    /// <inheritdoc />
+    public event Action<T>? Received;
+
+    /// <inheritdoc />
+    // Capture-then-invoke (via ?.) so a concurrent unsubscribe can't null the delegate mid-raise.
+    public void Publish(T item) => Received?.Invoke(item);
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/InMemoryDriverStatusSnapshotStore.cs

@@ -11,9 +11,16 @@ public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotSto
 {
     private readonly ConcurrentDictionary<string, DriverHealthChanged> _byInstance = new();
 
+    /// <inheritdoc />
+    public event Action<DriverHealthChanged>? SnapshotChanged;
+
     /// <inheritdoc />
     public void Upsert(DriverHealthChanged snapshot)
-        => _byInstance[snapshot.DriverInstanceId] = snapshot;
+    {
+        _byInstance[snapshot.DriverInstanceId] = snapshot;
+        // Capture-then-invoke so a concurrent unsubscribe can't null the delegate mid-raise.
+        SnapshotChanged?.Invoke(snapshot);
+    }
 
     /// <inheritdoc />
     public bool TryGet(string driverInstanceId, out DriverHealthChanged snapshot)

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/ScriptLogSignalRBridge.cs

@@ -15,18 +15,22 @@ public sealed class ScriptLogSignalRBridge : ReceiveActor
     public const string TopicName = "script-logs";
 
     private readonly IHubContext<ScriptLogHub> _hub;
+    private readonly IInProcessBroadcaster<ScriptLogEntry> _broadcaster;
     private readonly ILoggingAdapter _log = Context.GetLogger();
 
     /// <summary>Creates a Props instance for the ScriptLogSignalRBridge.</summary>
     /// <param name="hub">The SignalR hub context for sending messages to clients.</param>
-    public static Props Props(IHubContext<ScriptLogHub> hub) =>
-        Akka.Actor.Props.Create(() => new ScriptLogSignalRBridge(hub));
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Script log page.</param>
+    public static Props Props(IHubContext<ScriptLogHub> hub, IInProcessBroadcaster<ScriptLogEntry> broadcaster) =>
+        Akka.Actor.Props.Create(() => new ScriptLogSignalRBridge(hub, broadcaster));
 
     /// <summary>Initializes a new instance of the <see cref="ScriptLogSignalRBridge"/> class.</summary>
     /// <param name="hub">The SignalR hub context for sending messages to clients.</param>
-    public ScriptLogSignalRBridge(IHubContext<ScriptLogHub> hub)
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Script log page.</param>
+    public ScriptLogSignalRBridge(IHubContext<ScriptLogHub> hub, IInProcessBroadcaster<ScriptLogEntry> broadcaster)
     {
         _hub = hub;
+        _broadcaster = broadcaster;
         ReceiveAsync<ScriptLogEntry>(ForwardAsync);
         Receive<SubscribeAck>(_ => { /* DPS confirmation */ });
     }
@@ -37,6 +41,9 @@ public sealed class ScriptLogSignalRBridge : ReceiveActor
 
     private async Task ForwardAsync(ScriptLogEntry msg)
     {
+        // In-process fan-out first — this is what the Blazor Server Script log page reads. The hub
+        // push is kept for any out-of-process (e.g. WASM) SignalR client.
+        _broadcaster.Publish(msg);
         try
         {
             await _hub.Clients.All.SendAsync(ScriptLogHub.MethodName, msg);