feat(alarms): HiLo trigger type with per-band level, hysteresis, messages, overrides

Adds a new HiLo alarm trigger type with four configurable setpoints
(LoLo / Lo / Hi / HiHi). Each setpoint carries an optional priority,
deadband (for hysteresis), and operator message. The site runtime emits
AlarmStateChanged with an AlarmLevel field so consumers can differentiate
warning vs critical bands.

Plumbing:
  - new AlarmLevel enum + AlarmStateChanged.Level/Message init properties
  - AlarmTriggerEditor (Blazor) gets a HiLo render with severity tinting
  - AlarmTriggerConfigCodec extracted from the editor for testability
  - sitestream.proto carries level + message over gRPC
  - SemanticValidator enforces numeric attribute, setpoint ordering,
    non-negative deadband
  - on-trigger scripts get an Alarm global (Name/Level/Priority/Message)
    so notification routing can branch by severity
  - per-instance InstanceAlarmOverride entity + EF migration + flattening
    step + CLI commands; HiLo overrides merge setpoint-by-setpoint, binary
    types whole-replace
  - DebugView shows a Level badge + per-band message tooltip
  - App.razor auto-reloads on permanent Blazor circuit failure
  - docker/regen-proto.sh automates the proto regen workflow (the linux/arm64
    protoc segfault means generated files are checked in for now)

src/ScadaLink.CLI/Commands/InstanceCommands.cs

@@ -15,6 +15,7 @@ public static class InstanceCommands
         command.Add(BuildCreate(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildSetBindings(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildSetOverrides(urlOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildAlarmOverride(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildSetArea(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildDiff(urlOption, formatOption, usernameOption, passwordOption));
         command.Add(BuildDeploy(urlOption, formatOption, usernameOption, passwordOption));
@@ -186,6 +187,59 @@ public static class InstanceCommands
         return cmd;
     }
 
+    private static Command BuildAlarmOverride(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
+    {
+        var group = new Command("alarm-override") { Description = "Manage per-instance alarm overrides" };
+
+        // set
+        var setIdOption = new Option<int>("--instance-id") { Description = "Instance ID", Required = true };
+        var setAlarmOption = new Option<string>("--alarm") { Description = "Alarm canonical name (e.g., 'TempLevels' or 'Pump.TempSensor.Heat')", Required = true };
+        var setConfigOption = new Option<string?>("--trigger-config") { Description = "JSON override for TriggerConfiguration (HiLo: partial merge; others: whole-replace)" };
+        var setPriorityOption = new Option<int?>("--priority") { Description = "Priority override (0-1000)" };
+        var setCmd = new Command("set") { Description = "Set (upsert) an alarm override on an instance" };
+        setCmd.Add(setIdOption); setCmd.Add(setAlarmOption); setCmd.Add(setConfigOption); setCmd.Add(setPriorityOption);
+        setCmd.SetAction(async (ParseResult result) =>
+        {
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, urlOption, formatOption, usernameOption, passwordOption,
+                new SetInstanceAlarmOverrideCommand(
+                    result.GetValue(setIdOption),
+                    result.GetValue(setAlarmOption)!,
+                    result.GetValue(setConfigOption),
+                    result.GetValue(setPriorityOption)));
+        });
+        group.Add(setCmd);
+
+        // delete
+        var delIdOption = new Option<int>("--instance-id") { Description = "Instance ID", Required = true };
+        var delAlarmOption = new Option<string>("--alarm") { Description = "Alarm canonical name", Required = true };
+        var delCmd = new Command("delete") { Description = "Remove an alarm override on an instance" };
+        delCmd.Add(delIdOption); delCmd.Add(delAlarmOption);
+        delCmd.SetAction(async (ParseResult result) =>
+        {
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, urlOption, formatOption, usernameOption, passwordOption,
+                new DeleteInstanceAlarmOverrideCommand(
+                    result.GetValue(delIdOption),
+                    result.GetValue(delAlarmOption)!));
+        });
+        group.Add(delCmd);
+
+        // list
+        var listIdOption = new Option<int>("--instance-id") { Description = "Instance ID", Required = true };
+        var listCmd = new Command("list") { Description = "List all alarm overrides for an instance" };
+        listCmd.Add(listIdOption);
+        listCmd.SetAction(async (ParseResult result) =>
+        {
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, urlOption, formatOption, usernameOption, passwordOption,
+                new ListInstanceAlarmOverridesCommand(result.GetValue(listIdOption)));
+        });
+        group.Add(listCmd);
+
+        return group;
+    }
+
     private static Command BuildSetArea(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };