feat(alarms): HiLo trigger type with per-band level, hysteresis, messages, overrides

Adds a new HiLo alarm trigger type with four configurable setpoints
(LoLo / Lo / Hi / HiHi). Each setpoint carries an optional priority,
deadband (for hysteresis), and operator message. The site runtime emits
AlarmStateChanged with an AlarmLevel field so consumers can differentiate
warning vs critical bands.

Plumbing:
  - new AlarmLevel enum + AlarmStateChanged.Level/Message init properties
  - AlarmTriggerEditor (Blazor) gets a HiLo render with severity tinting
  - AlarmTriggerConfigCodec extracted from the editor for testability
  - sitestream.proto carries level + message over gRPC
  - SemanticValidator enforces numeric attribute, setpoint ordering,
    non-negative deadband
  - on-trigger scripts get an Alarm global (Name/Level/Priority/Message)
    so notification routing can branch by severity
  - per-instance InstanceAlarmOverride entity + EF migration + flattening
    step + CLI commands; HiLo overrides merge setpoint-by-setpoint, binary
    types whole-replace
  - DebugView shows a Level badge + per-band message tooltip
  - App.razor auto-reloads on permanent Blazor circuit failure
  - docker/regen-proto.sh automates the proto regen workflow (the linux/arm64
    protoc segfault means generated files are checked in for now)

src/ScadaLink.Commons/Entities/Instances/Instance.cs

@@ -11,6 +11,7 @@ public class Instance
     public string UniqueName { get; set; }
     public InstanceState State { get; set; }
     public ICollection<InstanceAttributeOverride> AttributeOverrides { get; set; } = new List<InstanceAttributeOverride>();
+    public ICollection<InstanceAlarmOverride> AlarmOverrides { get; set; } = new List<InstanceAlarmOverride>();
     public ICollection<InstanceConnectionBinding> ConnectionBindings { get; set; } = new List<InstanceConnectionBinding>();
 
     public Instance(string uniqueName)

src/ScadaLink.Commons/Entities/Instances/InstanceAlarmOverride.cs

@@ -0,0 +1,48 @@
+namespace ScadaLink.Commons.Entities.Instances;
+
+/// <summary>
+/// Per-instance override for a template-defined alarm. Lets a deployed
+/// instance tweak setpoints, priority, or per-band messages without forking
+/// the template. Locked alarms (TemplateAlarm.IsLocked) cannot be overridden
+/// — LockEnforcer rejects the change at write time.
+///
+/// Merge semantics (applied during flattening, after template inheritance and
+/// composition):
+///   • <see cref="TriggerConfigurationOverride"/> with a HiLo trigger merges
+///     into the inherited JSON setpoint-by-setpoint (derived keys win,
+///     inherited keys survive for unset derived keys). Same logic as
+///     template-to-template HiLo override, just one layer deeper.
+///   • For ValueMatch / RangeViolation / RateOfChange, the override replaces
+///     the whole TriggerConfiguration JSON (existing whole-replace semantics).
+///   • <see cref="PriorityLevelOverride"/> replaces the alarm's PriorityLevel
+///     when set.
+/// </summary>
+public class InstanceAlarmOverride
+{
+    public int Id { get; set; }
+    public int InstanceId { get; set; }
+
+    /// <summary>
+    /// Canonical name of the alarm being overridden — matches
+    /// <c>ResolvedAlarm.CanonicalName</c> after flattening, so composed-member
+    /// alarms are referenced as <c>[CompositionInstance].[AlarmName]</c>.
+    /// </summary>
+    public string AlarmCanonicalName { get; set; }
+
+    /// <summary>
+    /// Partial JSON (for HiLo) or full JSON (for binary trigger types) to
+    /// override the inherited TriggerConfiguration. <c>null</c> means
+    /// "leave inherited as-is".
+    /// </summary>
+    public string? TriggerConfigurationOverride { get; set; }
+
+    /// <summary>
+    /// Replaces the alarm's PriorityLevel when set. <c>null</c> = keep inherited.
+    /// </summary>
+    public int? PriorityLevelOverride { get; set; }
+
+    public InstanceAlarmOverride(string alarmCanonicalName)
+    {
+        AlarmCanonicalName = alarmCanonicalName ?? throw new ArgumentNullException(nameof(alarmCanonicalName));
+    }
+}