feat(alarms): HiLo trigger type with per-band level, hysteresis, messages, overrides

Adds a new HiLo alarm trigger type with four configurable setpoints
(LoLo / Lo / Hi / HiHi). Each setpoint carries an optional priority,
deadband (for hysteresis), and operator message. The site runtime emits
AlarmStateChanged with an AlarmLevel field so consumers can differentiate
warning vs critical bands.

Plumbing:
  - new AlarmLevel enum + AlarmStateChanged.Level/Message init properties
  - AlarmTriggerEditor (Blazor) gets a HiLo render with severity tinting
  - AlarmTriggerConfigCodec extracted from the editor for testability
  - sitestream.proto carries level + message over gRPC
  - SemanticValidator enforces numeric attribute, setpoint ordering,
    non-negative deadband
  - on-trigger scripts get an Alarm global (Name/Level/Priority/Message)
    so notification routing can branch by severity
  - per-instance InstanceAlarmOverride entity + EF migration + flattening
    step + CLI commands; HiLo overrides merge setpoint-by-setpoint, binary
    types whole-replace
  - DebugView shows a Level badge + per-band message tooltip
  - App.razor auto-reloads on permanent Blazor circuit failure
  - docker/regen-proto.sh automates the proto regen workflow (the linux/arm64
    protoc segfault means generated files are checked in for now)

src/ScadaLink.ConfigurationDatabase/Repositories/DeploymentManagerRepository.cs

@@ -169,6 +169,7 @@ public class DeploymentManagerRepository : IDeploymentManagerRepository
     {
         return await _dbContext.Set<Instance>()
             .Include(i => i.AttributeOverrides)
+            .Include(i => i.AlarmOverrides)
             .Include(i => i.ConnectionBindings)
             .FirstOrDefaultAsync(i => i.Id == instanceId, cancellationToken);
     }
@@ -177,6 +178,7 @@ public class DeploymentManagerRepository : IDeploymentManagerRepository
     {
         return await _dbContext.Set<Instance>()
             .Include(i => i.AttributeOverrides)
+            .Include(i => i.AlarmOverrides)
             .Include(i => i.ConnectionBindings)
             .FirstOrDefaultAsync(i => i.UniqueName == uniqueName, cancellationToken);
     }

src/ScadaLink.ConfigurationDatabase/Repositories/TemplateEngineRepository.cs

@@ -222,6 +222,7 @@ public class TemplateEngineRepository : ITemplateEngineRepository
     {
         return await _context.Instances
             .Include(i => i.AttributeOverrides)
+            .Include(i => i.AlarmOverrides)
             .Include(i => i.ConnectionBindings)
             .FirstOrDefaultAsync(i => i.Id == id, cancellationToken);
     }
@@ -230,6 +231,7 @@ public class TemplateEngineRepository : ITemplateEngineRepository
     {
         return await _context.Instances
             .Include(i => i.AttributeOverrides)
+            .Include(i => i.AlarmOverrides)
             .Include(i => i.ConnectionBindings)
             .ToListAsync(cancellationToken);
     }
@@ -246,6 +248,7 @@ public class TemplateEngineRepository : ITemplateEngineRepository
         return await _context.Instances
             .Where(i => i.SiteId == siteId)
             .Include(i => i.AttributeOverrides)
+            .Include(i => i.AlarmOverrides)
             .Include(i => i.ConnectionBindings)
             .ToListAsync(cancellationToken);
     }
@@ -254,6 +257,7 @@ public class TemplateEngineRepository : ITemplateEngineRepository
     {
         return await _context.Instances
             .Include(i => i.AttributeOverrides)
+            .Include(i => i.AlarmOverrides)
             .Include(i => i.ConnectionBindings)
             .FirstOrDefaultAsync(i => i.UniqueName == uniqueName, cancellationToken);
     }
@@ -307,6 +311,43 @@ public class TemplateEngineRepository : ITemplateEngineRepository
         }
     }
 
+    // InstanceAlarmOverride
+
+    public async Task<IReadOnlyList<InstanceAlarmOverride>> GetAlarmOverridesByInstanceIdAsync(int instanceId, CancellationToken cancellationToken = default)
+    {
+        return await _context.InstanceAlarmOverrides
+            .Where(o => o.InstanceId == instanceId)
+            .ToListAsync(cancellationToken);
+    }
+
+    public async Task<InstanceAlarmOverride?> GetAlarmOverrideAsync(int instanceId, string alarmCanonicalName, CancellationToken cancellationToken = default)
+    {
+        return await _context.InstanceAlarmOverrides
+            .FirstOrDefaultAsync(
+                o => o.InstanceId == instanceId && o.AlarmCanonicalName == alarmCanonicalName,
+                cancellationToken);
+    }
+
+    public async Task AddInstanceAlarmOverrideAsync(InstanceAlarmOverride alarmOverride, CancellationToken cancellationToken = default)
+    {
+        await _context.InstanceAlarmOverrides.AddAsync(alarmOverride, cancellationToken);
+    }
+
+    public Task UpdateInstanceAlarmOverrideAsync(InstanceAlarmOverride alarmOverride, CancellationToken cancellationToken = default)
+    {
+        _context.InstanceAlarmOverrides.Update(alarmOverride);
+        return Task.CompletedTask;
+    }
+
+    public async Task DeleteInstanceAlarmOverrideAsync(int id, CancellationToken cancellationToken = default)
+    {
+        var alarmOverride = await _context.InstanceAlarmOverrides.FindAsync(new object[] { id }, cancellationToken);
+        if (alarmOverride != null)
+        {
+            _context.InstanceAlarmOverrides.Remove(alarmOverride);
+        }
+    }
+
     // InstanceConnectionBinding
 
     public async Task<IReadOnlyList<InstanceConnectionBinding>> GetBindingsByInstanceIdAsync(int instanceId, CancellationToken cancellationToken = default)