fix(transport): NavMenu Admin-only visibility + BundleImportUnlockFailed audit + docker appsettings

- NavMenu: move Import Bundle out of the nested RequireDesign/RequireAdmin
  double-gate into the top-level Admin section so an Admin-only user sees it
  without needing the Design role; Export Bundle stays in the Design section.
- TransportImport: inject IAuditService + ScadaLinkDbContext; emit a
  BundleImportUnlockFailed audit row (best-effort, swallowed on failure) on
  every wrong-passphrase attempt in SubmitPassphraseAsync, with attempt
  number and error reason in afterState.
- docker central-node-a/b appsettings: add ScadaLink:Transport section with
  SourceEnvironment = "docker-cluster" so the importer picks up a non-null
  environment name in the audit trail.
- CentralUI.Tests: register IAuditService mock + SQLite in-memory
  ScadaLinkDbContext in TransportImportPageTests to satisfy the two new injects.

tests/ScadaLink.CentralUI.Tests/Pages/Design/TransportImportPageTests.cs

@@ -3,12 +3,16 @@ using System.Security.Cryptography;
 using Bunit;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
 using NSubstitute;
 using NSubstitute.ExceptionExtensions;
+using ScadaLink.Commons.Interfaces.Services;
 using ScadaLink.Commons.Interfaces.Transport;
 using ScadaLink.Commons.Types.Transport;
+using ScadaLink.ConfigurationDatabase;
 using ScadaLink.Security;
 using ScadaLink.Transport;
 using TransportImportPage = ScadaLink.CentralUI.Components.Pages.Design.TransportImport;
@@ -32,12 +36,14 @@ namespace ScadaLink.CentralUI.Tests.Pages.Design;
 public class TransportImportPageTests : BunitContext
 {
     private readonly IBundleImporter _importer = Substitute.For<IBundleImporter>();
+    private readonly IAuditService _auditService = Substitute.For<IAuditService>();
 
     public TransportImportPageTests()
     {
         JSInterop.Mode = JSRuntimeMode.Loose;
 
         Services.AddSingleton(_importer);
+        Services.AddSingleton(_auditService);
         Services.AddSingleton<IOptions<TransportOptions>>(
             Microsoft.Extensions.Options.Options.Create(new TransportOptions
             {
@@ -45,6 +51,17 @@ public class TransportImportPageTests : BunitContext
                 MaxUnlockAttemptsPerSession = 3,
             }));
 
+        // Provide a SQLite in-memory ScadaLinkDbContext so the page's
+        // DbContext.SaveChangesAsync() calls in the audit path succeed.
+        var dbOptions = new DbContextOptionsBuilder<ScadaLinkDbContext>()
+            .UseSqlite("DataSource=:memory:")
+            .ConfigureWarnings(w => w.Ignore(RelationalEventId.AmbientTransactionWarning))
+            .Options;
+        var dbContext = new ScadaLinkDbContext(dbOptions);
+        dbContext.Database.OpenConnection();
+        dbContext.Database.EnsureCreated();
+        Services.AddSingleton(dbContext);
+
         var principal = BuildPrincipal("alice", "Admin");
         Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(principal));
         Services.AddAuthorizationCore();