feat(alarms): HiLo trigger type with per-band level, hysteresis, messages, overrides

Adds a new HiLo alarm trigger type with four configurable setpoints
(LoLo / Lo / Hi / HiHi). Each setpoint carries an optional priority,
deadband (for hysteresis), and operator message. The site runtime emits
AlarmStateChanged with an AlarmLevel field so consumers can differentiate
warning vs critical bands.

Plumbing:
  - new AlarmLevel enum + AlarmStateChanged.Level/Message init properties
  - AlarmTriggerEditor (Blazor) gets a HiLo render with severity tinting
  - AlarmTriggerConfigCodec extracted from the editor for testability
  - sitestream.proto carries level + message over gRPC
  - SemanticValidator enforces numeric attribute, setpoint ordering,
    non-negative deadband
  - on-trigger scripts get an Alarm global (Name/Level/Priority/Message)
    so notification routing can branch by severity
  - per-instance InstanceAlarmOverride entity + EF migration + flattening
    step + CLI commands; HiLo overrides merge setpoint-by-setpoint, binary
    types whole-replace
  - DebugView shows a Level badge + per-band message tooltip
  - App.razor auto-reloads on permanent Blazor circuit failure
  - docker/regen-proto.sh automates the proto regen workflow (the linux/arm64
    protoc segfault means generated files are checked in for now)

src/ScadaLink.TemplateEngine/Validation/SemanticValidator.cs

@@ -136,6 +136,75 @@ public class SemanticValidator
                 }
             }
 
+            // HiLo requires numeric attribute + ordered setpoints
+            if (alarm.TriggerType == "HiLo" && !string.IsNullOrWhiteSpace(alarm.TriggerConfiguration))
+            {
+                var attrName = ValidationService.ExtractAttributeNameFromTriggerConfig(alarm.TriggerConfiguration);
+                if (attrName != null && attributeMap.TryGetValue(attrName, out var attr))
+                {
+                    if (!NumericDataTypes.Contains(attr.DataType))
+                    {
+                        errors.Add(ValidationEntry.Error(ValidationCategory.TriggerOperandType,
+                            $"Alarm '{alarm.CanonicalName}' uses HiLo trigger on attribute '{attrName}' which has non-numeric type '{attr.DataType}'.",
+                            alarm.CanonicalName));
+                    }
+                }
+
+                var setpoints = ValidationService.ExtractHiLoSetpoints(alarm.TriggerConfiguration);
+
+                // At least one setpoint must be configured — otherwise the alarm
+                // can never fire.
+                if (!setpoints.LoLo.HasValue && !setpoints.Lo.HasValue
+                    && !setpoints.Hi.HasValue && !setpoints.HiHi.HasValue)
+                {
+                    warnings.Add(ValidationEntry.Warning(ValidationCategory.TriggerOperandType,
+                        $"Alarm '{alarm.CanonicalName}' is HiLo but no setpoints (LoLo/Lo/Hi/HiHi) are configured — it will never fire.",
+                        alarm.CanonicalName));
+                }
+
+                // Ordering: LoLo ≤ Lo, Hi ≤ HiHi, and the highest Lo-side band
+                // must sit strictly below the lowest Hi-side band — otherwise the
+                // bands overlap and the evaluator's behavior is ambiguous.
+                if (setpoints.LoLo is { } loLo && setpoints.Lo is { } lo && loLo > lo)
+                {
+                    errors.Add(ValidationEntry.Error(ValidationCategory.TriggerOperandType,
+                        $"Alarm '{alarm.CanonicalName}' HiLo setpoints out of order: LoLo ({loLo}) must be ≤ Lo ({lo}).",
+                        alarm.CanonicalName));
+                }
+                if (setpoints.Hi is { } hi && setpoints.HiHi is { } hiHi && hi > hiHi)
+                {
+                    errors.Add(ValidationEntry.Error(ValidationCategory.TriggerOperandType,
+                        $"Alarm '{alarm.CanonicalName}' HiLo setpoints out of order: Hi ({hi}) must be ≤ HiHi ({hiHi}).",
+                        alarm.CanonicalName));
+                }
+                var highestLowSide = setpoints.Lo ?? setpoints.LoLo;
+                var lowestHighSide = setpoints.Hi ?? setpoints.HiHi;
+                if (highestLowSide is { } lowSide && lowestHighSide is { } highSide
+                    && lowSide >= highSide)
+                {
+                    errors.Add(ValidationEntry.Error(ValidationCategory.TriggerOperandType,
+                        $"Alarm '{alarm.CanonicalName}' HiLo bands overlap: low-side setpoint ({lowSide}) must be strictly less than high-side setpoint ({highSide}).",
+                        alarm.CanonicalName));
+                }
+
+                // Deadbands must be non-negative — negative deadband would invert
+                // the hysteresis (alarm could escape faster than it entered).
+                foreach (var (name, value) in new (string, double?)[] {
+                    ("LoLo deadband", setpoints.LoLoDeadband),
+                    ("Lo deadband", setpoints.LoDeadband),
+                    ("Hi deadband", setpoints.HiDeadband),
+                    ("HiHi deadband", setpoints.HiHiDeadband)
+                })
+                {
+                    if (value is { } d && d < 0)
+                    {
+                        errors.Add(ValidationEntry.Error(ValidationCategory.TriggerOperandType,
+                            $"Alarm '{alarm.CanonicalName}' {name} ({d}) must be non-negative.",
+                            alarm.CanonicalName));
+                    }
+                }
+            }
+
             // On-trigger script must exist
             if (!string.IsNullOrWhiteSpace(alarm.OnTriggerScriptCanonicalName) &&
                 !scriptNames.Contains(alarm.OnTriggerScriptCanonicalName))

src/ScadaLink.TemplateEngine/Validation/ValidationService.cs

@@ -232,4 +232,50 @@ public class ValidationService
         }
         return null;
     }
+
+    /// <summary>
+    /// Extracts the four HiLo setpoints from a trigger configuration JSON.
+    /// Any unset (or non-numeric) setpoint comes back as <c>null</c>. Returns
+    /// all-nulls on malformed JSON — callers should treat that as "nothing to
+    /// validate" and let other checks surface the deeper problem.
+    /// </summary>
+    internal static HiLoSetpoints ExtractHiLoSetpoints(string triggerConfigJson)
+    {
+        try
+        {
+            using var doc = JsonDocument.Parse(triggerConfigJson);
+            var root = doc.RootElement;
+            return new HiLoSetpoints(
+                LoLo: ReadDouble(root, "loLo"),
+                Lo:   ReadDouble(root, "lo"),
+                Hi:   ReadDouble(root, "hi"),
+                HiHi: ReadDouble(root, "hiHi"),
+                LoLoDeadband: ReadDouble(root, "loLoDeadband"),
+                LoDeadband:   ReadDouble(root, "loDeadband"),
+                HiDeadband:   ReadDouble(root, "hiDeadband"),
+                HiHiDeadband: ReadDouble(root, "hiHiDeadband"));
+        }
+        catch (JsonException)
+        {
+            return new HiLoSetpoints(null, null, null, null, null, null, null, null);
+        }
+    }
+
+    private static double? ReadDouble(JsonElement el, string name)
+    {
+        if (!el.TryGetProperty(name, out var p)) return null;
+        return p.ValueKind switch
+        {
+            JsonValueKind.Number => p.GetDouble(),
+            JsonValueKind.String when double.TryParse(p.GetString(),
+                System.Globalization.NumberStyles.Float,
+                System.Globalization.CultureInfo.InvariantCulture, out var v) => v,
+            _ => null
+        };
+    }
 }
+
+internal readonly record struct HiLoSetpoints(
+    double? LoLo, double? Lo, double? Hi, double? HiHi,
+    double? LoLoDeadband = null, double? LoDeadband = null,
+    double? HiDeadband = null, double? HiHiDeadband = null);