feat(cli,management): close area-move and template-folder CLI parity gaps

Two verified-absent parity gaps between the service layer and the CLI /
ManagementActor command surface, both left as follow-ups by the 2026-05-11
design plans.

(1) area move. AreaService.MoveAreaAsync had existed since the deployment
topology page shipped but was reachable only from the Blazor UI. Adds
MoveAreaCommand(AreaId, NewParentAreaId?) to Commons, a ManagementActor
dispatch arm delegating straight to AreaService.MoveAreaAsync (not-found /
self-parent / descendant-cycle / cross-site / name-collision all surface as
the standard curated ManagementCommandException failure response; the service
writes its own "Move" audit row), and the CLI verb `site area move --id
[--parent-id]`. Omitting --parent-id moves the area to the site root, matching
the command's nullable NewParentAreaId. The command carries the SAME any-of
[Designer, Deployer] gate as CreateArea/UpdateArea/DeleteArea (arch-review C6):
re-parenting is the same structural authoring act, exposed on the same two
surfaces. Placed under the existing `site area` group rather than a new
top-level `area` group, alongside its create/update/delete siblings.

(2) template folder verbs. The five folder management commands have been
handled by ManagementActor since the folder-hierarchy plan, but the promised
CLI surface was never written. Adds `template folder
list|create|rename|move|reorder|delete` mapping 1:1 onto ListTemplateFolders /
CreateTemplateFolder / RenameTemplateFolder / MoveTemplateFolder /
ReorderTemplateFolder / DeleteTemplateFolder. --parent-id is omitted to target
the tree root; --direction takes the lowercase literals up/down, validated at
parse time by AcceptOnlyFromAmong (same case-sensitive contract as the audit
--channel/--kind/--status options).

Follow-on updates: the frozen authorization matrix gains its MoveArea entry
(reflection-driven, so a missing entry would have failed CI); CommandTreeTests
pins both new verb sets plus the omit-parent-id-means-root parse behaviour and
registry round-trips; ManagementActorTests covers the MoveArea role gate and
the delegate-to-service success/root/cycle/not-found paths; the CLI README and
Component-ManagementService.md document the new surface (the latter also gained
the previously-undocumented ReorderTemplateFolder); both plan docs' follow-up
lines are marked done.

src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs

@@ -225,7 +225,8 @@ public class ManagementActor : ReceiveActor
         // Area management — any-of [Designer, Deployer] (arch-review C6).
         // Exposed both in the Designer tooling and inside the Central UI
         // Deployment Topology workflow (RequireDeployment), so both roles qualify.
-        CreateAreaCommand or UpdateAreaCommand or DeleteAreaCommand => AreaManagers,
+        CreateAreaCommand or UpdateAreaCommand or MoveAreaCommand
+            or DeleteAreaCommand => AreaManagers,
 
         // Designer operations
         CreateTemplateCommand or UpdateTemplateCommand or DeleteTemplateCommand
@@ -362,6 +363,7 @@ public class ManagementActor : ReceiveActor
             CreateAreaCommand cmd => await HandleCreateArea(sp, cmd, user.Username),
             DeleteAreaCommand cmd => await HandleDeleteArea(sp, cmd, user.Username),
             UpdateAreaCommand cmd => await HandleUpdateArea(sp, cmd, user.Username),
+            MoveAreaCommand cmd => await HandleMoveArea(sp, cmd, user.Username),
 
             // Data Connections
             ListDataConnectionsCommand cmd => await HandleListDataConnections(sp, cmd),
@@ -3116,6 +3118,22 @@ public class ManagementActor : ReceiveActor
         return area;
     }
 
+    /// <summary>
+    /// Re-parents an area within its site, delegating every validation rule
+    /// (not-found, self-parent, descendant-parent cycle, cross-site parent,
+    /// sibling name collision) to <c>AreaService.MoveAreaAsync</c>. A null
+    /// <c>NewParentAreaId</c> moves the area to the site root. Failures surface
+    /// as the standard curated <see cref="ManagementCommandException"/> failure
+    /// response, matching the sibling folder/template move handlers. The service
+    /// writes the "Move" audit row itself, so this handler does not audit again.
+    /// </summary>
+    private static async Task<object?> HandleMoveArea(IServiceProvider sp, MoveAreaCommand cmd, string user)
+    {
+        var svc = sp.GetRequiredService<AreaService>();
+        var result = await svc.MoveAreaAsync(cmd.AreaId, cmd.NewParentAreaId, user);
+        return result.IsSuccess ? result.Value : throw new ManagementCommandException(result.Error);
+    }
+
     // ========================================================================
     // Remote Query handlers
     // ========================================================================