Notification counts in the header and the security events view #2587

Part of #2422 (F-DSK). Fifth slice: in-app notification counts (DSK-05) and the security events view on the desk (SEC-08).

Scope

• Core (FluentCMS.Core.Audit):
  • SecurityEvents.Operations: the audit operations SEC-08 names, from the lanes that append them today:
    • agent credentials: agent_credential.issued, agent_credential.revoked
    • caps and refusals: agent.calls_per_period_exceeded, agent.change_sets_per_day_exceeded, agent.items_per_change_set_exceeded, agent.transition_refused
    • people's accounts: user.created, user.disabled, user.enabled, user.password_reset_issued, user.password_reset, user.login_linked
    • routing rules: routing_rule.created, routing_rule.revised, routing_rule.activated, routing_rule.deactivated, appended once routing rules (Add routing rules and their evaluation #2565) are on v2
  • IAuditEventLists, a read side for pages of the log: the events with any of the given operations, newest first, optionally since a time, with the total. It is separate from IAuditReader, which streams oldest first for exports. A list appends no event.
• Core (FluentCMS.Core.Desk): IDeskQueues.CountAsync(queue) counts one queue, so the header does not count all six.
• Infrastructure: AuditEventLists in its own file.
• Admin:
  • The header's Desk link shows how many sets await the signed-in person (awaiting me) as a badge. A Security link shows how many security events the last 24 hours hold. Counts are read on each page load. There is no email or push (DSK-06 is M2).
  • /security, linked from the desk: the security events, newest first, in pages of 50. Each shows what happened, who did it (agent or person, with the credential), the subject linked to its audit history, and when.
• Strings through IStringLocalizer, logical utilities only, components from Components/Ui only.

Out of scope

• "Injection flagged" (SEC-08): the instructions check (SEC-03) reports a finding in a check result, not an audit event. Once the check run (Run the checks on every submitted change set #2575) stores results, a flagged result can append its own event and join the list.
• Marking events as seen, and counts per user beyond awaiting me.
• Email and webhook notifications (DSK-06, M2).

Acceptance

• After an agent key is issued and revoked, an agent exceeds a cap and a person is disabled, /security lists those events, newest first, with who did them. Other events, such as a change set opened, are not listed.
• The header shows the awaiting-me count and the security count for the last day, and both change as sets and events change.
• Paging returns the right window and total. A bad window fails with a Result error, and a list appends no event.
• Integration tests pass on SQLite and PostgreSQL. The pages pass the axe checks from Keyboard-first batch review with roving focus, Playwright tests and WCAG checks #2582 in both directions.