feat(ui): drill-ins from detail pages to Audit Log (#23 M7)

Adds "Recent audit activity" deep links from four edit/detail pages into
the central Audit Log, each with a pre-filter encoded in the query string
that the Audit Log page (Bundle D0) now parses on initialization:

  - External Systems (Design/ExternalSystemForm)      → ?target={Name}
  - API Keys         (Admin/ApiKeyForm)                → ?actor={Name}&channel=ApiInbound
  - Sites            (Admin/SiteForm)                  → ?site={SiteIdentifier}
  - Instances        (Deployment/InstanceConfigure)    → ?instance={UniqueName}

The link is suppressed on create/new flows where there is nothing to
drill into yet. Instance is UI-only on the filter bar (the repository
filter contract has no instance column), so the page-side prefill threads
through the InitialInstanceSearch seam on AuditFilterBar.

Site Calls (#22 M7-T11) drill-in is DEFERRED: the Central UI does not
yet host a Site Calls listing page, per M3 reality notes. Add the
drill-in when that page lands.

#23 M7-T12

tests/ScadaLink.CentralUI.Tests/Deployment/InstanceConfigureAuditDrillinTests.cs

@@ -0,0 +1,100 @@
+using System.Security.Claims;
+using Bunit;
+using Microsoft.AspNetCore.Components;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.Extensions.DependencyInjection;
+using NSubstitute;
+using ScadaLink.CentralUI.Auth;
+using ScadaLink.Commons.Entities.Instances;
+using ScadaLink.Commons.Entities.Sites;
+using ScadaLink.Commons.Entities.Templates;
+using ScadaLink.Commons.Interfaces.Repositories;
+using ScadaLink.Commons.Interfaces.Services;
+using ScadaLink.DeploymentManager;
+using ScadaLink.Security;
+using ScadaLink.TemplateEngine.Services;
+using InstanceConfigurePage = ScadaLink.CentralUI.Components.Pages.Deployment.InstanceConfigure;
+
+namespace ScadaLink.CentralUI.Tests.Deployment;
+
+/// <summary>
+/// Bundle D drill-in test (#23 M7-T12) for the Instance Configure page. The
+/// chip routes operators into the central Audit Log pre-filtered by
+/// <c>?instance={Instance.UniqueName}</c>. Instance is UI-only on the filter
+/// bar (the repository filter contract has no instance column), so the page
+/// uses the UI-text seam — the Audit Log's filter bar pre-populates its
+/// Instance free-text input from this query string.
+/// </summary>
+public class InstanceConfigureAuditDrillinTests : BunitContext
+{
+    private readonly ITemplateEngineRepository _templateRepo =
+        Substitute.For<ITemplateEngineRepository>();
+    private readonly ISiteRepository _siteRepo = Substitute.For<ISiteRepository>();
+
+    public InstanceConfigureAuditDrillinTests()
+    {
+        // Loose JS interop because shared components on the page render
+        // localStorage / clipboard touches that we don't care about here.
+        JSInterop.Mode = JSRuntimeMode.Loose;
+
+        Services.AddSingleton(_templateRepo);
+        Services.AddSingleton(_siteRepo);
+
+        Services.AddSingleton(new InstanceService(_templateRepo, Substitute.For<IAuditService>()));
+        Services.AddSingleton(Substitute.For<IFlatteningPipeline>());
+
+        // Auth: a system-wide Deployment user so SiteScope grants everything.
+        var claims = new[]
+        {
+            new Claim("Username", "deployer"),
+            new Claim(JwtTokenService.RoleClaimType, "Deployment"),
+        };
+        var user = new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
+        var authProvider = new TestAuthStateProvider(user);
+        Services.AddSingleton<AuthenticationStateProvider>(authProvider);
+        Services.AddSingleton(new SiteScopeService(authProvider));
+        Services.AddAuthorizationCore();
+        AuthorizationPolicies.AddScadaLinkAuthorization(Services);
+    }
+
+    [Fact]
+    public void Page_HasRecentAuditActivityLink_WithInstanceUniqueName()
+    {
+        var instance = new Instance("Pump-Station-007")
+        {
+            Id = 42,
+            TemplateId = 1,
+            SiteId = 1,
+            State = ScadaLink.Commons.Types.Enums.InstanceState.NotDeployed,
+        };
+
+        _templateRepo.GetInstanceByIdAsync(42, Arg.Any<CancellationToken>()).Returns(instance);
+        _templateRepo.GetTemplateByIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new Template("Pump") { Id = 1 });
+        _siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>())
+            .Returns(new List<Site> { new("Plant A", "plant-a") { Id = 1 } });
+        _templateRepo.GetAreasBySiteIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<Area>());
+        _templateRepo.GetAttributesByTemplateIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<TemplateAttribute>());
+        _siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<DataConnection>());
+        _templateRepo.GetBindingsByInstanceIdAsync(42, Arg.Any<CancellationToken>())
+            .Returns(new List<InstanceConnectionBinding>());
+        _templateRepo.GetOverridesByInstanceIdAsync(42, Arg.Any<CancellationToken>())
+            .Returns(new List<InstanceAttributeOverride>());
+        _templateRepo.GetAlarmsByTemplateIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<TemplateAlarm>());
+        _templateRepo.GetAlarmOverridesByInstanceIdAsync(42, Arg.Any<CancellationToken>())
+            .Returns(new List<InstanceAlarmOverride>());
+
+        var cut = Render<InstanceConfigurePage>(p => p.Add(c => c.Id, 42));
+
+        cut.WaitForAssertion(() =>
+        {
+            var link = cut.Find("a[data-test=\"audit-link\"]");
+            Assert.Equal("/audit/log?instance=Pump-Station-007", link.GetAttribute("href"));
+            Assert.Contains("Recent audit activity", link.TextContent);
+        });
+    }
+}