feat(adminui): F15 Phase D — logic + ops pages

- ClusterAudit (/clusters/{id}/audit) — reads ConfigAuditLog with the
  EventId/CorrelationId columns added in F3; shown as a Cluster tab
- VirtualTags (/virtual-tags)            — fleet-wide read view
- ScriptedAlarms (/scripted-alarms)      — fleet-wide read view
- Scripts (/scripts)                     — fleet-wide; expandable code preview
- RoleGrants (/role-grants)              — per Q4, surfaces the fleet-wide
                                           LDAP-group → role mapping from
                                           Authentication:Ldap:GroupToRole
                                           (read-only; reload via host restart)
- Certificates (/certificates)           — own/trusted/issuer/rejected store
                                           contents resolved against
                                           OpcUa:PkiStoreRoot config (F13a)
- Reservations (/reservations)           — ExternalIdReservation table
- AlarmsHistorian (/alarms-historian)    — live HistorianAdapterActor sink
                                           status via the F11 GetStatus query;
                                           5s polling

ScriptLog deferred (needs the F16-deferred ScriptLogHub bridge).
ClusterNav extended with the Audit tab.

Adds an AdminUI → Runtime project reference so the historian status page can
inject IRequiredActor<HistorianAdapterActorKey>. NuGet audit suppression for
the transitive Opc.Ua.Core advisory mirrored from the Runtime project.

All 104 v2 tests still green.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ScriptedAlarms.razor

@@ -0,0 +1,84 @@
+@page "/scripted-alarms"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@rendermode RenderMode.InteractiveServer
+@using Microsoft.EntityFrameworkCore
+@using ZB.MOM.WW.OtOpcUa.Configuration
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h4 class="mb-0">Scripted alarms</h4>
+</div>
+
+@if (_rows is null)
+{
+    <p>Loading…</p>
+}
+else
+{
+    <section class="panel notice rise" style="animation-delay:.02s">
+        Scripted alarms watch a predicate script per equipment instance and fire OPC UA alarms
+        when the predicate transitions true. HistorizeToAveva routes events through the
+        Wonderware historian sidecar (F11) when enabled.
+    </section>
+
+    <section class="panel rise mt-3" style="animation-delay:.08s">
+        <div class="panel-head">@_rows.Count scripted alarm@(_rows.Count == 1 ? "" : "s")</div>
+        @if (_rows.Count == 0)
+        {
+            <div style="padding:1rem" class="text-muted">No scripted alarms defined.</div>
+        }
+        else
+        {
+            <div class="table-wrap">
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>ScriptedAlarmId</th>
+                            <th>Name</th>
+                            <th>Equipment</th>
+                            <th>Type</th>
+                            <th class="num">Severity</th>
+                            <th>Predicate</th>
+                            <th>Flags</th>
+                            <th>Status</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @foreach (var a in _rows)
+                        {
+                            <tr>
+                                <td><span class="mono small">@a.ScriptedAlarmId</span></td>
+                                <td>@a.Name</td>
+                                <td><span class="mono small">@a.EquipmentId</span></td>
+                                <td>@a.AlarmType</td>
+                                <td class="num">@a.Severity</td>
+                                <td><span class="mono small">@a.PredicateScriptId</span></td>
+                                <td>
+                                    @if (a.HistorizeToAveva) { <span class="chip chip-idle me-1">historize</span> }
+                                    @if (a.Retain) { <span class="chip chip-idle">retain</span> }
+                                </td>
+                                <td>
+                                    @if (a.Enabled) { <span class="chip chip-ok">Enabled</span> }
+                                    else { <span class="chip chip-idle">Disabled</span> }
+                                </td>
+                            </tr>
+                        }
+                    </tbody>
+                </table>
+            </div>
+        }
+    </section>
+}
+
+@code {
+    private List<ScriptedAlarm>? _rows;
+
+    protected override async Task OnInitializedAsync()
+    {
+        await using var db = await DbFactory.CreateDbContextAsync();
+        _rows = await db.ScriptedAlarms.AsNoTracking()
+            .OrderBy(a => a.Name)
+            .ToListAsync();
+    }
+}