feat: Implement provisioning pipelines for subscription management

- Add ReactivatePipeline to handle subscription reactivation, including scaling Docker services, health verification, status updates, audit logging, and broadcasting status changes.
- Introduce RotateCredentialsPipeline for OAuth2 credential rotation, managing the deletion of old apps, creation of new ones, credential storage, access verification, and audit logging.
- Create StepRunner to manage job step execution, including lifecycle management and progress broadcasting via SignalR.
- Implement SuspendPipeline for subscription suspension, scaling down services, updating statuses, logging audits, and broadcasting changes.
- Add UpdateScreenLimitPipeline to update Xibo CMS screen limits and record snapshots.
- Introduce XiboFeatureManifests for hardcoded feature ACLs per role.
- Add docker-compose.dev.yml for local development with PostgreSQL setup.

OTSSignsOrchestrator.Server/Health/IHealthCheck.cs

@@ -0,0 +1,32 @@
+using OTSSignsOrchestrator.Server.Data.Entities;
+
+namespace OTSSignsOrchestrator.Server.Health;
+
+/// <summary>
+/// Result of a single health check execution.
+/// </summary>
+public record HealthCheckResult(HealthStatus Status, string Message, string? Detail = null);
+
+/// <summary>
+/// Contract for an individual health check that runs against a specific <see cref="Instance"/>.
+/// </summary>
+public interface IHealthCheck
+{
+    /// <summary>Human-readable name written to <see cref="HealthEvent.CheckName"/>.</summary>
+    string CheckName { get; }
+
+    /// <summary>
+    /// When true the engine will automatically call <see cref="RemediateAsync"/>
+    /// if the check returns <see cref="HealthStatus.Critical"/>.
+    /// </summary>
+    bool AutoRemediate { get; }
+
+    /// <summary>Execute the check for <paramref name="instance"/>.</summary>
+    Task<HealthCheckResult> RunAsync(Instance instance, CancellationToken ct);
+
+    /// <summary>
+    /// Attempt automatic remediation. Return true if the issue was fixed.
+    /// The default implementation does nothing and returns false.
+    /// </summary>
+    Task<bool> RemediateAsync(Instance instance, CancellationToken ct) => Task.FromResult(false);
+}