feat(web.azure): port read-only pages (DeviceList, DeviceDetail, Audit, Settings) + WorkerStatusBadge

Phase 2 of the Web.Azure portal port. Mirrors the on-prem dashboard structure
so operators see the same UI when looking at Azure SQL data.

Pages ported (with minimal Azure adaptation):
- /devices         (DeviceList) — paginated/filtered consistency view
- /devices/{id}    (DeviceDetail) — keys comparison + admin-gated reveal that
                   re-checks AdminOnly server-side, decrypts via DataKeyService,
                   and audit-logs each reveal.
- /audit           (Audit) — paginated/filtered audit log + CSV export with
                   spreadsheet-formula-injection neutralization. AdminOnly.
- /settings        (Settings) — RuntimeConfig editor + passphrase. AdminOnly.
                   The on-prem "Run scan now" section is removed: the Azure
                   deployment has no scan Worker yet, so the trigger would
                   have no consumer.

Layout / shell:
- MainLayout.razor replaced with the on-prem sidebar layout (nav links gated
  by AuthorizeView AdminOnly / ViewerOrAdmin, sign-in/sign-out links, version).
- Components/Shared/WorkerStatusBadge.razor — graceful degradation: when no
  Worker writes WorkerHeartbeats (the default on Azure today) the badge
  renders "Worker: nessun heartbeat" instead of red-alarming Offline.
- Routes.razor — RouteView replaced with AuthorizeRouteView so the per-page
  [Authorize(Policy="AdminOnly")] attributes are actually enforced.
- _Imports.razor — added Core.Security, Core.Services, Core.Services.Interfaces,
  Web.Azure.Components.Shared usings.
- wwwroot/app.css — copied from on-prem (10 KB) so .dashboard-grid, .card,
  .badge, .filters, .worker-badge etc. render correctly.

Build green (Azure solution: Shared, Core, HybridAgent, Web.Azure, Functions
all built). Tests green: 86 Core + 8 HybridAgent + 15 Functions = 109 passed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

src/BitLockerKeyMonitor.Web.Azure/Components/Layout/MainLayout.razor

@@ -1,18 +1,44 @@
-@inherits LayoutComponentBase
+@inherits LayoutComponentBase
+@using System.Reflection
 
-<div class="page">
-    <div class="sidebar">
-        <NavMenu />
-    </div>
-
-    <main>
-        <div class="top-row px-4">
-            <a href="https://learn.microsoft.com/aspnet/core/" target="_blank">About</a>
+<div class="app-container">
+    <nav class="sidebar">
+        <div class="sidebar-header">
+            <h2>🔐 BLK Monitor <small style="font-weight:normal;font-size:.7rem;color:#9aa">Azure</small></h2>
+        </div>
+        <ul class="nav-menu">
+            <li><NavLink href="/" Match="NavLinkMatch.All">📊 Dashboard</NavLink></li>
+            <AuthorizeView Policy="ViewerOrAdmin">
+                <Authorized>
+                    <li><NavLink href="/devices">📋 Devices</NavLink></li>
+                </Authorized>
+            </AuthorizeView>
+            <AuthorizeView Policy="AdminOnly">
+                <Authorized>
+                    <li><NavLink href="/settings">⚙️ Settings</NavLink></li>
+                    <li><NavLink href="/audit">🔍 Audit</NavLink></li>
+                </Authorized>
+            </AuthorizeView>
+        </ul>
+        <div class="sidebar-footer">
+            <AuthorizeView>
+                <Authorized>
+                    <small class="sidebar-footer-user">👤 @context.User.Identity?.Name</small>
+                    <small><a href="MicrosoftIdentity/Account/SignOut" style="color:#9aa">Sign out</a></small>
+                </Authorized>
+                <NotAuthorized>
+                    <small><a href="MicrosoftIdentity/Account/SignIn" style="color:#9aa">Sign in</a></small>
+                </NotAuthorized>
+            </AuthorizeView>
+            <small class="sidebar-footer-version" title="@_versionFull">v@_versionDisplay</small>
         </div>
+    </nav>
 
-        <article class="content px-4">
-            @Body
-        </article>
+    <main class="main-content">
+        <header class="app-topbar">
+            <WorkerStatusBadge @rendermode="InteractiveServer" />
+        </header>
+        @Body
     </main>
 </div>
 
@@ -21,3 +47,14 @@
     <a href="." class="reload">Reload</a>
     <span class="dismiss">🗙</span>
 </div>
+
+@code {
+    private static readonly string _versionFull =
+        typeof(MainLayout).Assembly
+            .GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion
+        ?? typeof(MainLayout).Assembly.GetName().Version?.ToString()
+        ?? "unknown";
+
+    private static readonly string _versionDisplay =
+        _versionFull.Split('+', 2)[0];
+}