Run the header counts in their own scope so signed-in pages load on PostgreSQL #2635

Part of #2422 (F-DSK). Follow-up to #2590: findings from an independent review of the merged header counts and security events view. The raw SQL in AuditEventLists passes every value as a parameter, and the security operation list matches every SEC-08 event the code appends today.

Findings

1. High: signed-in pages fail on PostgreSQL. The header counts in NotificationLinks and the page body share the request's FluentCmsDbContext. Blazor starts the page's OnInitializedAsync while a header count is still awaiting Npgsql.
   • The request answers 500 with "A second operation was started on this context instance", or hangs on an Npgsql protocol error.
   • Loading /, /security, /audit, /users and /agents signed in failed 10 of 15 times on PostgreSQL on current v2, and 0 of 12 before Add notification counts in the header and the security events view #2590.
   • CI missed it because every host test runs on SQLite, whose async calls finish synchronously.
2. Medium: the Acceptance section isn't fully tested.
   • Nothing ties SecurityEvents.Operations to the operations the code appends, so a renamed user.disabled would drop off /security silently.
   • No host test runs on PostgreSQL.
   • "Both change as sets and events change" is covered only by bUnit with fakes.
3. Low: the axe check sees only an empty /security. The table, badges, links and pager are never checked.
4. Low: each /security load scans the audit log. No index covers Operation, and the count with no time limit filters every row.

Scope

• The header counts run in their own service scope, so they never share the page's DbContext.
• The host tests can run on PostgreSQL: TemporaryInstall takes the provider, and the signed-in pages are loaded repeatedly on both.
• A test appends each SEC-08 event through the code that appends it (agent cap, disable, key issue and revoke, user disable) and finds it on /security with who did it.
• A host test shows the counts change as a set moves and an event is appended.
• The axe check covers /security with events listed.
• An index on (Operation, Timestamp) for the audit log, with migrations for both providers.

Out of scope

• The LLM spend cap appends no audit event, so it can't reach /security. That is Record a spend cap refusal as a security event #2636.

Acceptance

• Signed-in pages load every time on PostgreSQL, checked by a host test that loads them repeatedly.
• Every SEC-08 event the code appends reaches /security, checked end to end.