fix(centralui): confirm dialogs name their own action instead of always saying "Delete" (register row 28)

The Health dashboard's "Trigger failover" confirmation offered a red button
labelled *Delete*. The copy was right; the button was not. `DialogHost` derived
the confirm label solely from `danger`, so `danger: true` meant the verb was
literally "Delete" for every caller — and no caller could say otherwise, because
`IDialogService.ConfirmAsync` had no label parameter.

`danger` now selects styling only; a new optional `confirmLabel` names the action
and wins over the fallback. The kind/danger fallback is deliberately RETAINED
("Save" for a prompt, "Delete" for a bare danger confirm, "Confirm" otherwise):
around 20 call sites are genuine deletes where it is correct, and the Playwright
suites click the literal "Delete". Requiring the label everywhere would have
churned those 20 sites for no behaviour change, with the miss-detection resting
on Playwright runs that need a live rig.

Audited all 34 confirm call sites; 9 read "Delete" for something that is not a
delete and are relabelled:

  Fail over  CentralFailoverControl (central pair, site pair)
  Approve    SecuredWrites — approve (this one WRITES TO A DEVICE)
  Reject     SecuredWrites — reject
  Disable    Topology — disable instance
  Discard    SiteCallsReport, NotificationReport, ParkedMessages (bulk + single)

The remaining 25 are correct as they stand: 18 genuine deletes plus 7 non-danger
confirms ("Revert to base", the three Retry paths) whose button reads "Confirm".

Tests: FailoverConfirmLabelTests drives the real DialogService behind a real
DialogHost — a substitute would pin the argument but not what the operator reads
— covering both branches, that the button keeps btn-danger, and that an
unlabelled danger confirm still falls back to "Delete". Note its click is
deliberately not awaited: with a real dialog the handler parks on ConfirmAsync
until answered, so awaiting deadlocks. Existing IDialogService fakes and
NSubstitute matchers gain the 4th parameter (an optional param is baked into the
call site, so a 3-arg Arg.Any stub silently stops matching a labelled call).

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Shared/DialogService.cs

@@ -35,12 +35,19 @@ public class DialogService : IDialogService
     private TaskCompletionSource<object?>? _tcs;
 
     /// <inheritdoc />
-    public Task<bool> ConfirmAsync(string title, string message, bool danger = false)
+    public Task<bool> ConfirmAsync(string title, string message, bool danger = false, string? confirmLabel = null)
     {
         EnsureNoActiveDialog();
         var tcs = new TaskCompletionSource<object?>(TaskCreationOptions.RunContinuationsAsynchronously);
         _tcs = tcs;
-        Current = new DialogState(title, DialogKind.Confirm, message, danger, PromptInitial: string.Empty, Placeholder: null);
+        Current = new DialogState(
+            title,
+            DialogKind.Confirm,
+            message,
+            danger,
+            PromptInitial: string.Empty,
+            Placeholder: null,
+            ConfirmLabel: confirmLabel);
         OnChange?.Invoke();
         return Project(tcs.Task, static r => r is bool b && b);
     }
@@ -146,6 +153,9 @@ public class DialogService : IDialogService
 /// render inside <c>.modal-body</c>; <c>null</c> for confirm/prompt.</param>
 /// <param name="Size">Optional Bootstrap modal-dialog size modifier class applied
 /// to the <c>modal-dialog</c> element (e.g. <c>modal-lg</c>); <c>null</c> = default.</param>
+/// <param name="ConfirmLabel">Explicit verb for the confirm button. <c>null</c> or
+/// blank falls back to the kind/danger default ("Save" for a prompt, "Delete" for a
+/// danger confirm, "Confirm" otherwise).</param>
 public record DialogState(
     string Title,
     DialogKind Kind,
@@ -154,7 +164,8 @@ public record DialogState(
     string PromptInitial,
     string? Placeholder,
     RenderFragment? Content = null,
-    string? Size = null);
+    string? Size = null,
+    string? ConfirmLabel = null);
 
 public enum DialogKind
 {