Phase 1 WP-2–10: Repositories, audit service, security & auth (LDAP, JWT, roles, policies, data protection)

- WP-2: SecurityRepository + CentralUiRepository with audit log queries
- WP-3: AuditService with transactional guarantee (same SaveChangesAsync)
- WP-4: Optimistic concurrency tests (deployment records vs template last-write-wins)
- WP-5: Seed data (SCADA-Admins → Admin role mapping)
- WP-6: LdapAuthService (direct bind, TLS enforcement, group query)
- WP-7: JwtTokenService (HMAC-SHA256, 15-min refresh, 30-min idle timeout)
- WP-8: RoleMapper (LDAP groups → roles with site-scoped deployment)
- WP-9: Authorization policies (Admin/Design/Deployment + site scope handler)
- WP-10: Shared Data Protection keys via EF Core
141 tests pass, zero warnings.

src/ScadaLink.ConfigurationDatabase/Migrations/20260316231942_SeedData.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ScadaLink.ConfigurationDatabase.Migrations
+{
+    /// <inheritdoc />
+    public partial class SeedData : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "LdapGroupMappings",
+                columns: new[] { "Id", "LdapGroupName", "Role" },
+                values: new object[] { 1, "SCADA-Admins", "Admin" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "LdapGroupMappings",
+                keyColumn: "Id",
+                keyValue: 1);
+        }
+    }
+}

src/ScadaLink.ConfigurationDatabase/Migrations/ScadaLinkDbContextModelSnapshot.cs

@@ -631,6 +631,14 @@ namespace ScadaLink.ConfigurationDatabase.Migrations
                         .IsUnique();
 
                     b.ToTable("LdapGroupMappings");
+
+                    b.HasData(
+                        new
+                        {
+                            Id = 1,
+                            LdapGroupName = "SCADA-Admins",
+                            Role = "Admin"
+                        });
                 });
 
             modelBuilder.Entity("ScadaLink.Commons.Entities.Security.SiteScopeRule", b =>