feat(auditlog): wire IAuditPayloadFilter into all writer paths (#23 M5)

Bundle C task M5-T6 — plugs the IAuditPayloadFilter singleton into the
three audit writer entry points so every event is truncated + redacted
before persistence, regardless of which path it took to disk:

  - FallbackAuditWriter (site hot path): filter runs before the primary
    SQLite write AND the ring-buffer enqueue, so a recovery drain replays
    rows that are already capped/redacted.
  - CentralAuditWriter (central direct-write): filter runs before the
    per-call IAuditLogRepository.InsertIfNotExistsAsync.
  - AuditLogIngestActor (site→central telemetry):
      - OnIngestAsync resolves the filter from the per-message scope and
        applies it to each row before IngestedAtUtc stamping.
      - OnCachedTelemetryAsync (M3 dual-write) applies the filter to the
        audit half of every CachedTelemetryEntry before the audit-insert
        + site-call-upsert transaction.

Filter parameter is optional (nullable) on each constructor so the
existing test composition roots that don't pass one keep working unchanged
— production DI wiring in AddAuditLog always passes the real filter
through. ICentralAuditWriter registration switched from the open-ctor
form to a factory so the filter flows through it.

Tests: FilterIntegrationTests covers all three writer paths end-to-end
(4 tests). Full ScadaLink.AuditLog.Tests suite: 146 passed, 0 failed,
0 skipped.

src/ScadaLink.AuditLog/ServiceCollectionExtensions.cs

@@ -106,11 +106,16 @@ public static class ServiceCollectionExtensions
         // The script-thread surface is FallbackAuditWriter (primary + ring +
         // counter), not the raw SqliteAuditWriter — primary failures must NEVER
         // abort the user-facing action.
+        // Bundle C (M5-T6): the IAuditPayloadFilter singleton above is wired
+        // through the factory so every event written through this surface is
+        // truncated + redacted before it hits SQLite (and the ring on
+        // failure).
         services.AddSingleton<IAuditWriter>(sp => new FallbackAuditWriter(
             primary: sp.GetRequiredService<SqliteAuditWriter>(),
             ring: sp.GetRequiredService<RingBufferFallback>(),
             failureCounter: sp.GetRequiredService<IAuditWriteFailureCounter>(),
-            logger: sp.GetRequiredService<ILogger<FallbackAuditWriter>>()));
+            logger: sp.GetRequiredService<ILogger<FallbackAuditWriter>>(),
+            filter: sp.GetRequiredService<IAuditPayloadFilter>()));
 
         // ISiteStreamAuditClient: NoOp default. M6's reconciliation work brings
         // the real gRPC-backed implementation (no site→central gRPC channel
@@ -155,7 +160,13 @@ public static class ServiceCollectionExtensions
         // is intentionally distinct from IAuditWriter so site composition roots
         // do not accidentally bind it; central composition roots that include
         // AddConfigurationDatabase get a working implementation transparently.
-        services.AddSingleton<ICentralAuditWriter, CentralAuditWriter>();
+        // Bundle C (M5-T6): wire the IAuditPayloadFilter into the factory so
+        // NotificationOutboxActor + Inbound API rows are truncated + redacted
+        // before they hit MS SQL.
+        services.AddSingleton<ICentralAuditWriter>(sp => new CentralAuditWriter(
+            sp,
+            sp.GetRequiredService<ILogger<CentralAuditWriter>>(),
+            sp.GetRequiredService<IAuditPayloadFilter>()));
 
         return services;
     }