feat(ui): drill-ins from detail pages to Audit Log (#23 M7)

Adds "Recent audit activity" deep links from four edit/detail pages into
the central Audit Log, each with a pre-filter encoded in the query string
that the Audit Log page (Bundle D0) now parses on initialization:

  - External Systems (Design/ExternalSystemForm)      → ?target={Name}
  - API Keys         (Admin/ApiKeyForm)                → ?actor={Name}&channel=ApiInbound
  - Sites            (Admin/SiteForm)                  → ?site={SiteIdentifier}
  - Instances        (Deployment/InstanceConfigure)    → ?instance={UniqueName}

The link is suppressed on create/new flows where there is nothing to
drill into yet. Instance is UI-only on the filter bar (the repository
filter contract has no instance column), so the page-side prefill threads
through the InitialInstanceSearch seam on AuditFilterBar.

Site Calls (#22 M7-T11) drill-in is DEFERRED: the Central UI does not
yet host a Site Calls listing page, per M3 reality notes. Add the
drill-in when that page lands.

#23 M7-T12

tests/ScadaLink.CentralUI.Tests/Design/ExternalSystemFormAuditDrillinTests.cs

@@ -0,0 +1,70 @@
+using System.Security.Claims;
+using Bunit;
+using Microsoft.AspNetCore.Components;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.Extensions.DependencyInjection;
+using NSubstitute;
+using ScadaLink.Commons.Entities.ExternalSystems;
+using ScadaLink.Commons.Interfaces.Repositories;
+using ScadaLink.Security;
+using ExternalSystemForm = ScadaLink.CentralUI.Components.Pages.Design.ExternalSystemForm;
+
+namespace ScadaLink.CentralUI.Tests.Design;
+
+/// <summary>
+/// Bundle D drill-in test (#23 M7-T12) for the External Systems edit page.
+/// The page-header chip routes operators into the central Audit Log
+/// pre-filtered by Target = external-system name. Create mode has nothing
+/// to drill into yet, so the link is suppressed.
+/// </summary>
+public class ExternalSystemFormAuditDrillinTests : BunitContext
+{
+    private readonly IExternalSystemRepository _repo = Substitute.For<IExternalSystemRepository>();
+
+    public ExternalSystemFormAuditDrillinTests()
+    {
+        Services.AddSingleton(_repo);
+
+        var claims = new[]
+        {
+            new Claim("Username", "tester"),
+            new Claim(JwtTokenService.RoleClaimType, "Design"),
+        };
+        var user = new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
+        Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(user));
+        Services.AddAuthorizationCore();
+        AuthorizationPolicies.AddScadaLinkAuthorization(Services);
+    }
+
+    [Fact]
+    public void EditPage_HasRecentAuditActivityLink_WithTargetEqualToSystemName()
+    {
+        _repo.GetExternalSystemByIdAsync(7, Arg.Any<CancellationToken>())
+            .Returns(new ExternalSystemDefinition("ERP-Alpha", "https://erp.example.test", "ApiKey")
+            {
+                Id = 7,
+            });
+
+        var cut = Render<ExternalSystemForm>(p => p.Add(c => c.Id, 7));
+
+        cut.WaitForAssertion(() =>
+        {
+            var link = cut.Find("a[data-test=\"audit-link\"]");
+            Assert.Equal("/audit/log?target=ERP-Alpha", link.GetAttribute("href"));
+            Assert.Contains("Recent audit activity", link.TextContent);
+        });
+    }
+
+    [Fact]
+    public void CreatePage_HasNoRecentAuditActivityLink()
+    {
+        // Create mode (Id is null) — there's no real external system to drill into,
+        // so the link must not render.
+        var cut = Render<ExternalSystemForm>();
+
+        cut.WaitForAssertion(() =>
+        {
+            Assert.Empty(cut.FindAll("a[data-test=\"audit-link\"]"));
+        });
+    }
+}