[pournasserian]

Closes #2587

What

The fifth slice of F-DSK (#2422): in-app notification counts (DSK-05) and the security events view on the desk (SEC-08).

• Core (FluentCMS.Core.Audit):
  • SecurityEvents.Operations: the operations SEC-08 names.
    • Agent keys issued and revoked.
    • The three cap refusals and an agent's refused move.
    • People added, disabled and enabled, password resets issued and used, and external sign-ins linked.
    • Routing rules created, revised, activated and deactivated. Those match nothing until routing rules (Add routing rules and their evaluation #2565) merge.
  • IAuditEventLists: a page of the log with any of the given operations, newest first, optionally since a time, with the total. CountAsync gives the total alone. A bad window fails with offset_invalid or limit_invalid, and no operations with audit_operations_missing. It is separate from IAuditReader, which streams the log oldest first for exports.
• Core (FluentCMS.Core.Desk): IDeskQueues.CountAsync(queue) counts one queue, so the header does not count all six.
• Infrastructure: AuditEventLists in its own file, SQL over AuditEvents as in AuditReader.
• Admin:
  • NotificationLinks in the header replaces the plain Desk link.
    • Desk shows how many sets await the signed-in person (awaiting me).
    • A new Security link shows how many security events the last 24 hours hold.
    • Each count is a badge with a screen-reader suffix and appears only when it is above zero. Counts are read on each page load.
  • /security: the events newest first, in pages of 50. Each row has the time, a sentence for the operation, who acted (agent, person or system badge and name) and the subject, linked to its audit history. The rows rove like the desk's.
  • The desk links to /security.

Why

• A list of operation names in Core. Each lane appends its own events, and the desk should not depend on all of them. An operation nobody appends yet costs nothing, so routing rules can be named now.
• Counts per page load. M1 has in-app counts only (DSK-05). The layout is static, so a count is current on every navigation without a circuit or polling. Each count is one indexed query.
• The last day for the security badge. A count of everything ever recorded would never fall back to zero. One day is enough for a daily check, and NotificationLinks.SecurityWithin is the one place to change it.
• Not in this PR:
  • "Injection flagged" (SEC-08): the instructions check (SEC-03) reports a finding in a check result, not an audit event. Once check results are stored (Run the checks on every submitted change set #2575), a flagged result can append its own event and join the list.
  • Marking events as seen, and email (DSK-06, M2).

Tests

Unit:

• DeskQueuesTests: one queue is counted on its own, stale facts included.
• bUnit SecurityEventsViewTests:
  • Each row has its sentence, initiator, subject link and time, and the query names the security operations.
  • The page comes from the address and links to its neighbours, and an empty log says so.
  • The header shows both counts only when they are above zero, and counts security events since one day ago.

Integration:

• On SQLite and PostgreSQL: a list holds only the named operations, newest first, with the total, a window and a time from any offset.
• A bad window or no operation is refused, and a list appends nothing.
• Host: after a key is issued and revoked, /security lists both newest first, links the credential's history and leaves out the change set events. The header counts one set awaiting the owner and two security events. An anonymous request goes to sign-in.
• Browser: the axe WCAG 2.1 AA check now covers /security too, in both directions and themes.

dotnet build -warnaserror and the full suite with the browser tests pass locally against a postgres:17 container as well as SQLite. No new package and no new project reference.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers