Phase 1 WP-2–10: Repositories, audit service, security & auth (LDAP, JWT, roles, policies, data protection)

- WP-2: SecurityRepository + CentralUiRepository with audit log queries
- WP-3: AuditService with transactional guarantee (same SaveChangesAsync)
- WP-4: Optimistic concurrency tests (deployment records vs template last-write-wins)
- WP-5: Seed data (SCADA-Admins → Admin role mapping)
- WP-6: LdapAuthService (direct bind, TLS enforcement, group query)
- WP-7: JwtTokenService (HMAC-SHA256, 15-min refresh, 30-min idle timeout)
- WP-8: RoleMapper (LDAP groups → roles with site-scoped deployment)
- WP-9: Authorization policies (Admin/Design/Deployment + site scope handler)
- WP-10: Shared Data Protection keys via EF Core
141 tests pass, zero warnings.

tests/ScadaLink.ConfigurationDatabase.Tests/SeedDataTests.cs

@@ -0,0 +1,37 @@
+using Microsoft.EntityFrameworkCore;
+using ScadaLink.ConfigurationDatabase;
+
+namespace ScadaLink.ConfigurationDatabase.Tests;
+
+public class SeedDataTests : IDisposable
+{
+    private readonly ScadaLinkDbContext _context;
+
+    public SeedDataTests()
+    {
+        var options = new DbContextOptionsBuilder<ScadaLinkDbContext>()
+            .UseSqlite("DataSource=:memory:")
+            .Options;
+
+        _context = new ScadaLinkDbContext(options);
+        _context.Database.OpenConnection();
+        _context.Database.EnsureCreated();
+    }
+
+    public void Dispose()
+    {
+        _context.Database.CloseConnection();
+        _context.Dispose();
+    }
+
+    [Fact]
+    public async Task SeedData_AdminMappingExists()
+    {
+        var adminMapping = await _context.LdapGroupMappings
+            .SingleOrDefaultAsync(m => m.LdapGroupName == "SCADA-Admins");
+
+        Assert.NotNull(adminMapping);
+        Assert.Equal("Admin", adminMapping.Role);
+        Assert.Equal(1, adminMapping.Id);
+    }
+}