feat: Implement provisioning pipelines for subscription management

- Add ReactivatePipeline to handle subscription reactivation, including scaling Docker services, health verification, status updates, audit logging, and broadcasting status changes.
- Introduce RotateCredentialsPipeline for OAuth2 credential rotation, managing the deletion of old apps, creation of new ones, credential storage, access verification, and audit logging.
- Create StepRunner to manage job step execution, including lifecycle management and progress broadcasting via SignalR.
- Implement SuspendPipeline for subscription suspension, scaling down services, updating statuses, logging audits, and broadcasting changes.
- Add UpdateScreenLimitPipeline to update Xibo CMS screen limits and record snapshots.
- Introduce XiboFeatureManifests for hardcoded feature ACLs per role.
- Add docker-compose.dev.yml for local development with PostgreSQL setup.

OTSSignsOrchestrator.Server/Hubs/FleetHub.cs

@@ -0,0 +1,49 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.SignalR;
+
+namespace OTSSignsOrchestrator.Server.Hubs;
+
+/// <summary>
+/// Server→client push-only hub for real-time fleet notifications.
+/// Desktop clients never send messages via SignalR — they use REST for commands.
+/// </summary>
+[Authorize]
+public class FleetHub : Hub<IFleetClient>
+{
+    private readonly ILogger<FleetHub> _logger;
+
+    public FleetHub(ILogger<FleetHub> logger)
+    {
+        _logger = logger;
+    }
+
+    public override Task OnConnectedAsync()
+    {
+        var name = Context.User?.FindFirst(ClaimTypes.Name)?.Value ?? "unknown";
+        _logger.LogInformation("FleetHub: operator {Name} connected (connId={ConnectionId})",
+            name, Context.ConnectionId);
+        return base.OnConnectedAsync();
+    }
+
+    public override Task OnDisconnectedAsync(Exception? exception)
+    {
+        var name = Context.User?.FindFirst(ClaimTypes.Name)?.Value ?? "unknown";
+        _logger.LogInformation("FleetHub: operator {Name} disconnected (connId={ConnectionId})",
+            name, Context.ConnectionId);
+        return base.OnDisconnectedAsync(exception);
+    }
+}
+
+/// <summary>
+/// Strongly-typed client interface for FleetHub push messages.
+/// Inject IHubContext&lt;FleetHub, IFleetClient&gt; to call these from services.
+/// </summary>
+public interface IFleetClient
+{
+    Task SendJobCreated(string jobId, string abbrev, string jobType);
+    Task SendJobProgressUpdate(string jobId, string stepName, int pct, string logLine);
+    Task SendJobCompleted(string jobId, bool success, string summary);
+    Task SendInstanceStatusChanged(string customerId, string status);
+    Task SendAlertRaised(string severity, string message);
+}