feat: achieve CLI parity with Central UI

Add 33 new management message records, ManagementActor handlers, and CLI
commands to close all functionality gaps between the Central UI and the
Management CLI. New capabilities include:

- Template member CRUD (attributes, alarms, scripts, compositions)
- Shared script CRUD
- Database connection definition CRUD
- Inbound API method CRUD
- LDAP scope rule management
- API key enable/disable
- Area update
- Remote event log and parked message queries
- Missing get/update commands for templates, sites, instances, data
  connections, external systems, notifications, and SMTP config

Includes 12 new ManagementActor unit tests covering authorization,
happy-path queries, and error handling. Updates CLI README and component
design documents (Component-CLI.md, Component-ManagementService.md).

Component-ManagementService.md

@@ -45,12 +45,19 @@ The ManagementActor registers itself with `ClusterClientReceptionist` at startup
 - **ValidateTemplate**: Run on-demand pre-deployment validation (flattening, naming collisions, script compilation).
 - **GetTemplateDiff**: Compare deployed vs. template-derived configuration for an instance.
 
+### Template Members
+
+- **AddTemplateAttribute** / **UpdateTemplateAttribute** / **DeleteTemplateAttribute**: Manage attributes on a template.
+- **AddTemplateAlarm** / **UpdateTemplateAlarm** / **DeleteTemplateAlarm**: Manage alarm definitions on a template.
+- **AddTemplateScript** / **UpdateTemplateScript** / **DeleteTemplateScript**: Manage scripts on a template.
+- **AddTemplateComposition** / **DeleteTemplateComposition**: Manage feature module compositions on a template.
+
 ### Instances
 
 - **ListInstances** / **GetInstance**: Query instances, with filtering by site and area.
 - **CreateInstance**: Create a new instance from a template.
 - **UpdateInstanceOverrides**: Set attribute overrides on an instance.
-- **BindDataConnections**: Bind data connections to instance attributes.
+- **SetInstanceBindings** / **BindDataConnections**: Bind data connections to instance attributes.
 - **AssignArea**: Assign an instance to an area.
 - **EnableInstance** / **DisableInstance** / **DeleteInstance**: Instance lifecycle commands.
 
@@ -85,25 +92,47 @@ The ManagementActor registers itself with `ClusterClientReceptionist` at startup
 
 ### Security (LDAP & API Keys)
 
-- **ListApiKeys** / **CreateApiKey** / **EnableApiKey** / **DisableApiKey** / **DeleteApiKey**: Manage API keys.
+- **ListApiKeys** / **CreateApiKey** / **UpdateApiKey** / **EnableApiKey** / **DisableApiKey** / **DeleteApiKey**: Manage API keys.
 - **ListRoleMappings** / **CreateRoleMapping** / **UpdateRoleMapping** / **DeleteRoleMapping**: Manage LDAP group-to-role mappings.
+- **ListScopeRules** / **AddScopeRule** / **DeleteScopeRule**: Manage site scope rules on role mappings.
 
 ### Audit Log
 
 - **QueryAuditLog**: Query audit log entries with filtering by entity type, user, date range, etc.
 
+### Shared Scripts
+
+- **ListSharedScripts** / **GetSharedScript**: Query shared script definitions.
+- **CreateSharedScript** / **UpdateSharedScript** / **DeleteSharedScript**: Manage shared scripts.
+
+### Database Connections
+
+- **ListDatabaseConnections** / **GetDatabaseConnection**: Query database connection definitions.
+- **CreateDatabaseConnection** / **UpdateDatabaseConnection** / **DeleteDatabaseConnection**: Manage database connections.
+
+### Inbound API Methods
+
+- **ListApiMethods** / **GetApiMethod**: Query inbound API method definitions.
+- **CreateApiMethod** / **UpdateApiMethod** / **DeleteApiMethod**: Manage inbound API methods.
+
 ### Health
 
 - **GetHealthSummary**: Query current health status of all sites.
 - **GetSiteHealth**: Query detailed health for a specific site.
 
+### Remote Queries
+
+- **QuerySiteEventLog**: Query site event log entries from a remote site (routed via communication layer). Supports date range, keyword search, and pagination.
+- **QueryParkedMessages**: Query parked (dead-letter) messages at a remote site (routed via communication layer). Supports pagination.
+
 ## Authorization
 
 Every incoming message carries the authenticated user's identity and roles. The ManagementActor enforces the same role-based authorization rules as the Central UI:
 
-- **Admin** role required for: site management, area management, API key management, role mapping management, system configuration.
-- **Design** role required for: template authoring, shared scripts, external system definitions, database connection definitions, notification lists, inbound API method definitions.
-- **Deployment** role required for: instance management, deployments, debug view, parked message management, site event log viewing. Site scoping is enforced for site-scoped Deployment users.
+- **Admin** role required for: site management, area management, API key management, role mapping management, scope rule management, system configuration.
+- **Design** role required for: template authoring (including template member management: attributes, alarms, scripts, compositions), shared scripts, external system definitions, database connection definitions, notification lists, inbound API method definitions.
+- **Deployment** role required for: instance management, deployments, debug view, parked message queries, site event log queries. Site scoping is enforced for site-scoped Deployment users.
+- **Read-only access** (any authenticated role): health summary, health site, site event log queries, parked message queries.
 
 Unauthorized commands receive an `Unauthorized` response message. Failed authorization attempts are not audit logged (consistent with existing behavior).
 
@@ -120,7 +149,8 @@ The ManagementActor receives the following services and repositories via DI (inj
 - `INotificationRepository` — Notification lists and SMTP config.
 - `ISecurityRepository` — API keys and LDAP role mappings.
 - `IInboundApiRepository` — Inbound API method definitions.
-- `ICentralUiRepository` — UI-related queries (shared scripts, database connections).
+- `ISharedScriptRepository` / `SharedScriptService` — Shared script definitions.
+- `IDatabaseConnectionRepository` — Database connection definitions.
 - `ICentralHealthAggregator` — Health status aggregation.
 - `CommunicationService` — Central-site communication for deployment and remote queries.