feat(host): register Audit Log #23 singletons with dedicated dispatcher (#23)

Wires Bundle E of the M2 site-sync pipeline:

- AddAuditLog extended to register the site writer chain (SqliteAuditWriter
  singleton + ISiteAuditQueue forward + RingBufferFallback + FallbackAuditWriter
  composing them) and the telemetry collaborators (SiteAuditTelemetryOptions,
  SqliteAuditWriterOptions, IAuditWriteFailureCounter NoOp default,
  ISiteStreamAuditClient NoOp default).
- AkkaHostedService central role: AuditLogIngestActor as ClusterSingletonManager
  (singleton name 'audit-log-ingest') + ClusterSingletonProxy, mirroring the
  Notification Outbox pattern. Proxy is offered to SiteStreamGrpcServer if it
  resolves (Site path only today; M6 reconciliation will host gRPC on central).
- AkkaHostedService site role: SiteAuditTelemetryActor (per-site, NOT a
  singleton because each site is its own cluster), bound to a dedicated
  audit-telemetry-dispatcher (ForkJoinDispatcher, 2 dedicated threads).
- Program.cs + SiteServiceRegistration.Configure call AddAuditLog on both roles.
- AuditLogIngestActor gains a second constructor that takes IServiceProvider so
  the cluster singleton can create a fresh scope per message — IAuditLogRepository
  is a scoped EF Core service and cannot be pre-resolved from the root. The
  IAuditLogRepository constructor remains for Bundle D's MSSQL-fixture tests.

NoOp ISiteStreamAuditClient is deliberate: no site→central gRPC channel exists
in M2 (sites talk to central via Akka ClusterClient; gRPC SiteStreamService is
hosted on sites for central→site streaming). M6 reconciliation introduces the
real gRPC site→central client + central-hosted gRPC server. Bundle H's
integration test substitutes a stub client directly via the actor's Props.

Tests:
- tests/ScadaLink.AuditLog.Tests/AddAuditLogTests.cs — 11 tests (was 3): writer
  singleton, IAuditWriter as FallbackAuditWriter, ISiteAuditQueue same-instance
  as SqliteAuditWriter, options bind round-trip, NoOp default assertions.
- tests/ScadaLink.Host.Tests/AkkaHostedServiceAuditWiringTests.cs (new) — 13
  tests: BuildHocon emits audit-telemetry-dispatcher block with the expected
  type/throughput/thread-count; Central composition root resolves the writer
  chain + options; Site composition root resolves the writer chain + options +
  NoOp client.

Verified: dotnet build clean, 23 test suites green (Host 194 + AuditLog 54).

src/ScadaLink.AuditLog/ServiceCollectionExtensions.cs

@@ -1,44 +1,106 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using ScadaLink.AuditLog.Configuration;
+using ScadaLink.AuditLog.Site;
+using ScadaLink.AuditLog.Site.Telemetry;
+using ScadaLink.Commons.Interfaces.Services;
 
 namespace ScadaLink.AuditLog;
 
 /// <summary>
-/// Composition root for the Audit Log (#23) component. M1 registers
-/// <see cref="AuditLogOptions"/> and its validator; later milestones extend
-/// this method to wire up writers, telemetry actors, and the central ingest
-/// pipeline. Audit Log (#23) sits alongside Notification Outbox (#21) and
-/// Site Call Audit (#22).
+/// Composition root for the Audit Log (#23) component.
 /// </summary>
+/// <remarks>
+/// <para>
+/// M1 registered <see cref="AuditLogOptions"/> + the validator. M2 Bundle E
+/// extends the surface with the site-side writer chain
+/// (<see cref="SqliteAuditWriter"/> + <see cref="RingBufferFallback"/> +
+/// <see cref="FallbackAuditWriter"/>) and the telemetry collaborators
+/// (<see cref="ISiteAuditQueue"/>, <see cref="ISiteStreamAuditClient"/>,
+/// <see cref="IAuditWriteFailureCounter"/>, <see cref="SiteAuditTelemetryOptions"/>,
+/// <see cref="SqliteAuditWriterOptions"/>).
+/// </para>
+/// <para>
+/// Audit Log (#23) sits alongside Notification Outbox (#21) and Site Call
+/// Audit (#22). <c>IAuditLogRepository</c> is registered by
+/// <c>ScadaLink.ConfigurationDatabase.ServiceCollectionExtensions.AddConfigurationDatabase</c>,
+/// so the caller (the Host on the central node) must also call that.
+/// </para>
+/// </remarks>
 public static class ServiceCollectionExtensions
 {
     /// <summary>Configuration section bound to <see cref="AuditLogOptions"/>.</summary>
     public const string ConfigSectionName = "AuditLog";
 
+    /// <summary>Configuration section bound to <see cref="SqliteAuditWriterOptions"/>.</summary>
+    public const string SiteWriterSectionName = "AuditLog:SiteWriter";
+
+    /// <summary>Configuration section bound to <see cref="SiteAuditTelemetryOptions"/>.</summary>
+    public const string SiteTelemetrySectionName = "AuditLog:SiteTelemetry";
+
     /// <summary>
-    /// Binds <see cref="AuditLogOptions"/> from the
-    /// <see cref="ConfigSectionName"/> section of <paramref name="config"/>
-    /// and registers <see cref="AuditLogOptionsValidator"/> so a misconfigured
-    /// <c>AuditLog</c> section is rejected with a key-naming message when the
-    /// options are first resolved (or at startup when consumers wire in
-    /// <c>ValidateOnStart()</c>). M2+ will register writers, telemetry actors,
-    /// and the central ingest pipeline here. <c>IAuditLogRepository</c> is
-    /// registered by
-    /// <c>ScadaLink.ConfigurationDatabase.ServiceCollectionExtensions.AddConfigurationDatabase</c>,
-    /// so the caller (the Host on the central node) must also call that.
+    /// Registers the Audit Log (#23) component services: options, the site
+    /// SQLite writer chain (primary + ring fallback + failure-counter sink),
+    /// and the site-→central telemetry collaborators. Idempotent re-registration
+    /// is not supported; call this exactly once per <see cref="IServiceCollection"/>.
     /// </summary>
     public static IServiceCollection AddAuditLog(this IServiceCollection services, IConfiguration config)
     {
         ArgumentNullException.ThrowIfNull(services);
         ArgumentNullException.ThrowIfNull(config);
 
+        // M1: top-level AuditLogOptions + validator (redaction policy, payload caps, etc.).
         services.AddOptions<AuditLogOptions>()
             .Bind(config.GetSection(ConfigSectionName))
             .ValidateOnStart();
         services.AddSingleton<IValidateOptions<AuditLogOptions>, AuditLogOptionsValidator>();
 
+        // M2 Bundle E: site writer + telemetry options bindings.
+        // BindConfiguration is not used because the configuration root supplied
+        // by the caller may not be the application root — we go through the
+        // section explicitly so a partial IConfiguration (e.g. a test stub
+        // anchored on the AuditLog section's parent) still works.
+        services.AddOptions<SqliteAuditWriterOptions>()
+            .Bind(config.GetSection(SiteWriterSectionName));
+        services.AddOptions<SiteAuditTelemetryOptions>()
+            .Bind(config.GetSection(SiteTelemetrySectionName));
+
+        // SqliteAuditWriter is a singleton with a single owned SqliteConnection
+        // and a background writer Task; multiple instances would race on the
+        // same file. Registered concretely so the ISiteAuditQueue + IAuditWriter
+        // forwards below resolve to the same instance — the actor must observe
+        // the writes made via the hot-path interface.
+        services.AddSingleton<SqliteAuditWriter>();
+        services.AddSingleton<ISiteAuditQueue>(sp => sp.GetRequiredService<SqliteAuditWriter>());
+
+        // RingBufferFallback: drop-oldest in-memory ring used by
+        // FallbackAuditWriter when the primary SQLite writer throws. Default
+        // capacity is fine for M2 (1024).
+        services.AddSingleton<RingBufferFallback>();
+
+        // IAuditWriteFailureCounter: NoOp default. Bundle G overrides this
+        // binding with the real Site Health Monitoring counter. Registered
+        // before FallbackAuditWriter so the factory can resolve it.
+        services.AddSingleton<IAuditWriteFailureCounter, NoOpAuditWriteFailureCounter>();
+
+        // The script-thread surface is FallbackAuditWriter (primary + ring +
+        // counter), not the raw SqliteAuditWriter — primary failures must NEVER
+        // abort the user-facing action.
+        services.AddSingleton<IAuditWriter>(sp => new FallbackAuditWriter(
+            primary: sp.GetRequiredService<SqliteAuditWriter>(),
+            ring: sp.GetRequiredService<RingBufferFallback>(),
+            failureCounter: sp.GetRequiredService<IAuditWriteFailureCounter>(),
+            logger: sp.GetRequiredService<ILogger<FallbackAuditWriter>>()));
+
+        // ISiteStreamAuditClient: NoOp default. M6's reconciliation work brings
+        // the real gRPC-backed implementation (no site→central gRPC channel
+        // exists today — sites talk to central via Akka ClusterClient only).
+        // Bundle H's integration test substitutes a stub directly into the
+        // SiteAuditTelemetryActor's Props.Create call.
+        services.AddSingleton<ISiteStreamAuditClient, NoOpSiteStreamAuditClient>();
+
         return services;
     }
 }