feat(notifications): OAuth2 authority/scope management + CLI + UI surfaces

Additive UpdateSmtpConfigCommand params (OAuth2Authority/OAuth2Scope),
preserve-on-null handler application, CLI --oauth2-authority/--oauth2-scope
on smtp update, Central UI text inputs shown only for the OAuth2 auth type,
and the Component-NotificationService doc paragraph with M365 defaults.

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -1820,6 +1820,8 @@ public class ManagementActor : ReceiveActor
             c.MaxConcurrentConnections,
             c.MaxRetries,
             c.RetryDelay,
+            c.OAuth2Authority,
+            c.OAuth2Scope,
             HasCredentials = !string.IsNullOrEmpty(c.Credentials),
         };
 
@@ -1846,6 +1848,10 @@ public class ManagementActor : ReceiveActor
         // existing values intact (non-breaking for callers that do not send them).
         if (cmd.TlsMode is not null) config.TlsMode = cmd.TlsMode;
         if (cmd.Credentials is not null) config.Credentials = cmd.Credentials;
+        // Preserve-if-null likewise for the OAuth2 token-endpoint overrides: an
+        // omitted authority/scope leaves the stored value (or its M365 default) intact.
+        if (cmd.OAuth2Authority is not null) config.OAuth2Authority = cmd.OAuth2Authority;
+        if (cmd.OAuth2Scope is not null) config.OAuth2Scope = cmd.OAuth2Scope;
         await repo.UpdateSmtpConfigurationAsync(config);
         await repo.SaveChangesAsync();
         // Audit the credential-free shape — the *fact of* the change