feat(alarms): structural degraded-status signal for truncated alarm snapshots

The truncation-cliff fix made alarm transitions truncation-safe but silent:
when GetXmlCurrentAlarms2 returns exactly maxAlmCnt records the worker
suppresses absence-implies-Clear inference and says so only in a rate-limited
stderr warning. No client and no operator could tell a complete active set
from a capped one.

Two additive proto3 booleans carry the verdict out:

- QueryActiveAlarmsReplyPayload.snapshot_truncated = 2 (worker IPC reply)
- ActiveAlarmSnapshot.from_truncated_snapshot = 16 (per record)

The per-record field is not an aesthetic choice. QueryActiveAlarms returns a
bare `stream ActiveAlarmSnapshot` with no envelope, header, or trailer, so a
per-record boolean is the only carrier that stays wire-compatible; an envelope
message would change every existing client's stream element type. The reply
payload states it too because a prefix filter can leave zero records and a
truncated fetch with nothing to report still has to say so. The flag means
"this set may be incomplete", never "this record is unreliable" — it is
independent of the subtag-fallback `degraded` field.

Detection is deliberately UNCHANGED: IsTruncatedFetch remains
`fetchedRecordCount >= maxAlarmsPerFetch`. The live probe (docs/AlarmProbeFindings.md,
ce5d8ae) could not verify whether ALARM_RECORDS/@COUNT reports the total active
count or only the records in the reply, so @COUNT is not parsed for detection;
switching to it stays blocked on probe evidence. The probe's comment
annotations in WnWrapAlarmConsumer.cs are preserved.

Reset semantics: not latched. WnWrapAlarmConsumer.FoldFetch replaces the
verdict on every poll under the same lock as the snapshot merge, so the first
sub-cap fetch clears it; GatewayAlarmMonitor.ClearCache drops it with the cache
generation it describes. A caveat that never turns off is one operators learn
to ignore.

Flow: WnWrapAlarmConsumer.LastSnapshotTruncated -> AlarmDispatcher (stamps every
record) / IAlarmCommandHandler (payload) -> MxAccessCommandExecutor reply ->
GatewayAlarmMonitor._snapshotTruncated -> IGatewayAlarmService.SnapshotTruncated
-> DashboardAlarmQueryResult -> AlarmsPage warning banner (render-side only; the
poll loop and DisposeAsync drain are untouched). The public QueryActiveAlarms
RPC forwards worker snapshots unmodified, so the per-record flag needed no
mapper change — a test pins that.

Parity: this describes OUR fetch mechanics — additive gateway metadata — not
MXAccess provider behavior. No event is synthesized and no MXAccess-observable
semantics change, so it is not a parity deviation.

Tests: worker LastSnapshotTruncated set/reset/consecutive-burst (windev-run);
gateway end-to-end truncated reply -> monitor -> public stream, with the
complete-reply control as the load-bearing assertion; AlarmsPage banner
present/absent. Docs: gateway.md alarm surface, docs/DesignDecisions.md entry.

src/ZB.MOM.WW.MxGateway.Server/Dashboard/IDashboardSessionAcl.cs

@@ -0,0 +1,33 @@
+using System.Security.Claims;
+
+namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
+
+/// <summary>
+/// Decides whether a dashboard principal may observe one session's mirrored
+/// event stream (SEC-25 / TST-15). Consulted at every subscribe seam: the
+/// SignalR <c>EventsHub.SubscribeSession</c> join and the in-process
+/// <c>IDashboardSessionEventSubscriber.Subscribe</c> used by the
+/// session-details page.
+/// </summary>
+/// <remarks>
+/// The dashboard authenticates LDAP users while sessions are owned by API keys —
+/// two disjoint identity domains — so the bridge is the session <em>tag</em>: a
+/// session inherits its owning key's tags, and a dashboard group grants tags via
+/// <c>MxGateway:Dashboard:GroupToTag</c>. See
+/// <c>docs/plans/2026-07-10-dashboard-session-acl-tst15.md</c>.
+/// </remarks>
+public interface IDashboardSessionAcl
+{
+    /// <summary>
+    /// Returns whether <paramref name="principal"/> may observe the events of the
+    /// session identified by <paramref name="sessionId"/>.
+    /// </summary>
+    /// <param name="principal">
+    /// The dashboard caller. <see langword="null"/>, unauthenticated, or claim-less
+    /// principals (including the anonymous-localhost path) are treated as Viewers
+    /// holding an empty tag grant.
+    /// </param>
+    /// <param name="sessionId">Session id the caller wants to observe.</param>
+    /// <returns><see langword="true"/> when the caller may observe the session; otherwise <see langword="false"/>.</returns>
+    bool CanViewSession(ClaimsPrincipal? principal, string sessionId);
+}