feat: add HTTP Management API, migrate CLI from Akka ClusterClient to HTTP

Replace the CLI's Akka.NET ClusterClient transport with a simple HTTP client
targeting a new POST /management endpoint on the Central Host. The endpoint
handles Basic Auth, LDAP authentication, role resolution, and ManagementActor
dispatch in a single round-trip — eliminating the CLI's Akka, LDAP, and
Security dependencies.

Also fixes DCL ReSubscribeAll losing subscriptions on repeated reconnect by
deriving the tag list from _subscriptionsByInstance instead of _subscriptionIds.

src/ScadaLink.ManagementService/ManagementEndpoints.cs

@@ -0,0 +1,151 @@
+using System.Text;
+using System.Text.Json;
+using Akka.Actor;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ScadaLink.Commons.Messages.Management;
+using ScadaLink.Security;
+
+namespace ScadaLink.ManagementService;
+
+public static class ManagementEndpoints
+{
+    private static readonly TimeSpan AskTimeout = TimeSpan.FromSeconds(30);
+
+    public static IEndpointRouteBuilder MapManagementAPI(this IEndpointRouteBuilder endpoints)
+    {
+        endpoints.MapPost("/management", (Delegate)HandleRequest);
+        return endpoints;
+    }
+
+    private static async Task<IResult> HandleRequest(HttpContext context)
+    {
+        var logger = context.RequestServices.GetRequiredService<ILogger<ManagementActorHolder>>();
+
+        // 1. Decode Basic Auth
+        var authHeader = context.Request.Headers.Authorization.ToString();
+        if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Basic ", StringComparison.OrdinalIgnoreCase))
+        {
+            return Results.Json(new { error = "Authorization header required (Basic scheme).", code = "AUTH_FAILED" }, statusCode: 401);
+        }
+
+        string username, password;
+        try
+        {
+            var decoded = Encoding.UTF8.GetString(Convert.FromBase64String(authHeader["Basic ".Length..]));
+            var colon = decoded.IndexOf(':');
+            if (colon < 0) throw new FormatException();
+            username = decoded[..colon];
+            password = decoded[(colon + 1)..];
+        }
+        catch
+        {
+            return Results.Json(new { error = "Malformed Basic Auth header.", code = "AUTH_FAILED" }, statusCode: 401);
+        }
+
+        if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))
+        {
+            return Results.Json(new { error = "Username and password are required.", code = "AUTH_FAILED" }, statusCode: 401);
+        }
+
+        // 2. LDAP authentication
+        var ldapAuth = context.RequestServices.GetRequiredService<LdapAuthService>();
+        var authResult = await ldapAuth.AuthenticateAsync(username, password);
+        if (!authResult.Success)
+        {
+            return Results.Json(
+                new { error = authResult.ErrorMessage ?? "Authentication failed.", code = "AUTH_FAILED" },
+                statusCode: 401);
+        }
+
+        // 3. Role resolution
+        var roleMapper = context.RequestServices.GetRequiredService<RoleMapper>();
+        var mappingResult = await roleMapper.MapGroupsToRolesAsync(
+            authResult.Groups ?? (IReadOnlyList<string>)Array.Empty<string>());
+
+        var permittedSiteIds = mappingResult.IsSystemWideDeployment
+            ? Array.Empty<string>()
+            : mappingResult.PermittedSiteIds.ToArray();
+
+        var authenticatedUser = new AuthenticatedUser(
+            authResult.Username!,
+            authResult.DisplayName!,
+            mappingResult.Roles.ToArray(),
+            permittedSiteIds);
+
+        // 4. Parse command from request body
+        JsonDocument doc;
+        try
+        {
+            doc = await JsonDocument.ParseAsync(context.Request.Body);
+        }
+        catch
+        {
+            return Results.Json(new { error = "Invalid JSON body.", code = "BAD_REQUEST" }, statusCode: 400);
+        }
+
+        if (!doc.RootElement.TryGetProperty("command", out var commandNameElement))
+        {
+            return Results.Json(new { error = "Missing 'command' field.", code = "BAD_REQUEST" }, statusCode: 400);
+        }
+
+        var commandName = commandNameElement.GetString();
+        if (string.IsNullOrWhiteSpace(commandName))
+        {
+            return Results.Json(new { error = "Empty 'command' field.", code = "BAD_REQUEST" }, statusCode: 400);
+        }
+
+        var commandType = ManagementCommandRegistry.Resolve(commandName);
+        if (commandType == null)
+        {
+            return Results.Json(new { error = $"Unknown command: '{commandName}'.", code = "BAD_REQUEST" }, statusCode: 400);
+        }
+
+        object command;
+        try
+        {
+            var payloadElement = doc.RootElement.TryGetProperty("payload", out var p)
+                ? p
+                : JsonDocument.Parse("{}").RootElement;
+            command = JsonSerializer.Deserialize(payloadElement.GetRawText(), commandType,
+                new JsonSerializerOptions { PropertyNameCaseInsensitive = true })!;
+        }
+        catch (Exception ex)
+        {
+            return Results.Json(new { error = $"Failed to deserialize payload: {ex.Message}", code = "BAD_REQUEST" }, statusCode: 400);
+        }
+
+        // 5. Dispatch to ManagementActor
+        var holder = context.RequestServices.GetRequiredService<ManagementActorHolder>();
+        if (holder.ActorRef == null)
+        {
+            return Results.Json(new { error = "Management service not ready.", code = "SERVICE_UNAVAILABLE" }, statusCode: 503);
+        }
+
+        var correlationId = Guid.NewGuid().ToString("N");
+        var envelope = new ManagementEnvelope(authenticatedUser, command, correlationId);
+
+        object response;
+        try
+        {
+            response = await holder.ActorRef.Ask(envelope, AskTimeout);
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "ManagementActor Ask timed out or failed (CorrelationId={CorrelationId})", correlationId);
+            return Results.Json(new { error = "Request timed out.", code = "TIMEOUT" }, statusCode: 504);
+        }
+
+        // 6. Map response
+        return response switch
+        {
+            ManagementSuccess success => Results.Text(success.JsonData, "application/json", statusCode: 200),
+            ManagementError error => Results.Json(new { error = error.Error, code = error.ErrorCode }, statusCode: 400),
+            ManagementUnauthorized unauth => Results.Json(new { error = unauth.Message, code = "UNAUTHORIZED" }, statusCode: 403),
+            _ => Results.Json(new { error = "Unexpected response.", code = "INTERNAL_ERROR" }, statusCode: 500)
+        };
+    }
+}