feat(template-engine): resolve TemplateEngine-002 — per-slot alarm override for derived templates

Adds IsInherited/LockedInDerived to the TemplateAlarm entity (mirroring the
attribute/script override model), an EF migration, base-alarm copy-on-derive,
inherited-alarm flattening skip, and LockedInDerived override-rejection validation.

src/ScadaLink.TemplateEngine/Flattening/FlatteningService.cs

@@ -180,13 +180,14 @@ public class FlatteningService
 
     /// <summary>
     /// Reports any LockedInDerived violations across the chain — i.e., a base
-    /// attribute/script marked LockedInDerived that a downstream derived
+    /// attribute/alarm/script marked LockedInDerived that a downstream derived
     /// template overrides (IsInherited=false). Returns null on success or an
     /// error message describing the first offending entries.
     /// </summary>
     private static string? ValidateLockedInDerived(IReadOnlyList<Template> templateChain)
     {
         var attrLocks = new Dictionary<string, Template>(StringComparer.Ordinal);
+        var alarmLocks = new Dictionary<string, Template>(StringComparer.Ordinal);
         var scriptLocks = new Dictionary<string, Template>(StringComparer.Ordinal);
         var errors = new List<string>();
 
@@ -202,6 +203,14 @@ public class FlatteningService
                     errors.Add($"Attribute '{attr.Name}' is LockedInDerived by base template '{lockingTemplate.Name}' and cannot be overridden by '{template.Name}'.");
             }
 
+            foreach (var alarm in template.Alarms)
+            {
+                if (alarm.LockedInDerived)
+                    alarmLocks[alarm.Name] = template;
+                else if (!alarm.IsInherited && alarmLocks.TryGetValue(alarm.Name, out var lockingTemplate) && lockingTemplate.Id != template.Id)
+                    errors.Add($"Alarm '{alarm.Name}' is LockedInDerived by base template '{lockingTemplate.Name}' and cannot be overridden by '{template.Name}'.");
+            }
+
             foreach (var script in template.Scripts)
             {
                 if (script.LockedInDerived)
@@ -385,8 +394,16 @@ public class FlatteningService
 
             foreach (var alarm in template.Alarms)
             {
-                if (result.TryGetValue(alarm.Name, out var existing) && existing.IsLocked)
-                    continue;
+                if (result.TryGetValue(alarm.Name, out var existing))
+                {
+                    if (existing.IsLocked)
+                        continue;
+                    // IsInherited rows on a derived template are placeholders
+                    // that must not shadow the live base alarm; they only
+                    // contribute a row when the base lacks one.
+                    if (alarm.IsInherited)
+                        continue;
+                }
 
                 // HiLo per-setpoint override: derived templates can supply a
                 // partial TriggerConfiguration (e.g., just `hi`) and have the

src/ScadaLink.TemplateEngine/TemplateService.cs

@@ -398,6 +398,16 @@ public class TemplateService
             if (parentMember != null && parentMember.IsLocked)
                 return Result<TemplateAlarm>.Failure(
                     $"Alarm '{existing.Name}' is locked in parent and cannot be overridden.");
+
+            // Derived templates may not override alarms the base marked LockedInDerived.
+            if (template.IsDerived)
+            {
+                var baseTemplate = await _repository.GetTemplateByIdAsync(template.ParentTemplateId.Value, cancellationToken);
+                var baseAlarm = baseTemplate?.Alarms.FirstOrDefault(a => a.Name == existing.Name);
+                if (baseAlarm != null && baseAlarm.LockedInDerived)
+                    return Result<TemplateAlarm>.Failure(
+                        $"Alarm '{existing.Name}' is locked by base template '{baseTemplate!.Name}' and cannot be overridden.");
+            }
         }
 
         // Validate fixed fields
@@ -411,6 +421,10 @@ public class TemplateService
         existing.Description = proposed.Description;
         existing.OnTriggerScriptId = proposed.OnTriggerScriptId;
         existing.IsLocked = proposed.IsLocked;
+        if (template?.IsDerived == true)
+            existing.IsInherited = proposed.IsInherited;
+        else
+            existing.LockedInDerived = proposed.LockedInDerived;
         // Name and TriggerType are NOT updated (fixed)
 
         await _repository.UpdateTemplateAlarmAsync(existing, cancellationToken);
@@ -818,6 +832,21 @@ public class TemplateService
             });
         }
 
+        foreach (var alarm in baseTemplate.Alarms)
+        {
+            derived.Alarms.Add(new TemplateAlarm(alarm.Name)
+            {
+                Description = alarm.Description,
+                PriorityLevel = alarm.PriorityLevel,
+                IsLocked = alarm.IsLocked,
+                TriggerType = alarm.TriggerType,
+                TriggerConfiguration = alarm.TriggerConfiguration,
+                OnTriggerScriptId = alarm.OnTriggerScriptId,
+                IsInherited = true,
+                LockedInDerived = false,
+            });
+        }
+
         foreach (var script in baseTemplate.Scripts)
         {
             derived.Scripts.Add(new TemplateScript(script.Name, script.Code)