feat(comms): PullAuditEvents RPC for audit reconciliation (#23 M6)

src/ScadaLink.Communication/Protos/sitestream.proto

@@ -9,6 +9,7 @@ service SiteStreamService {
   rpc SubscribeInstance(InstanceStreamRequest) returns (stream SiteStreamEvent);
   rpc IngestAuditEvents(AuditEventBatch) returns (IngestAck);
   rpc IngestCachedTelemetry(CachedTelemetryBatch) returns (IngestAck);
+  rpc PullAuditEvents(PullAuditEventsRequest) returns (PullAuditEventsResponse);
 }
 
 message InstanceStreamRequest {
@@ -119,3 +120,19 @@ message CachedTelemetryPacket {
 }
 
 message CachedTelemetryBatch { repeated CachedTelemetryPacket packets = 1; }
+
+// Audit Log (#23) M6 reconciliation pull: central→site request for any
+// site-local AuditLog rows with OccurredAtUtc >= since_utc that have not yet
+// been ingested centrally (ForwardState in {Pending, Forwarded}). The site
+// flips returned rows to Reconciled after the response is on the wire.
+// more_available signals batch_size was saturated so the caller knows to
+// issue a follow-up pull with an advanced since_utc cursor.
+message PullAuditEventsRequest {
+  google.protobuf.Timestamp since_utc = 1;
+  int32 batch_size = 2;
+}
+
+message PullAuditEventsResponse {
+  repeated AuditEventDto events = 1;
+  bool more_available = 2;
+}