fix(auth): move AddZbLdapAuth to Host composition root so component-lib AddSecurity() drops IConfiguration param (satisfy OptionsTests arch rule; fix pre-existing ac34dac red); behaviour-preserving

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -1,4 +1,5 @@
 using ZB.MOM.WW.Auth.ApiKeys.DependencyInjection;
+using ZB.MOM.WW.Auth.AspNetCore;
 using ZB.MOM.WW.Health;
 using ZB.MOM.WW.Health.Akka;
 using ZB.MOM.WW.Health.EntityFrameworkCore;
@@ -104,7 +105,16 @@ try
         builder.Services.AddSiteCallAudit();
         builder.Services.AddTemplateEngine();
         builder.Services.AddDeploymentManager();
-        builder.Services.AddSecurity(builder.Configuration);
+        // Host is the composition root and owns config-coupled wiring: register the
+        // shared LDAP auth (binds LdapOptions + IValidateOptions<LdapOptions> with
+        // ValidateOnStart + ILdapAuthService singleton) here, then AddSecurity() for the
+        // config-free remainder. AddSecurity is a component library and takes no
+        // IConfiguration (Options pattern only). Behaviour-preserving: identical
+        // registrations to the previous AddSecurity(builder.Configuration) call.
+        builder.Services.AddZbLdapAuth(
+            builder.Configuration,
+            ZB.MOM.WW.ScadaBridge.Security.ServiceCollectionExtensions.LdapSectionPath);
+        builder.Services.AddSecurity();
         builder.Services.AddCentralUI();
         builder.Services.AddInboundAPI();