feat(cli,management): close area-move and template-folder CLI parity gaps

Two verified-absent parity gaps between the service layer and the CLI /
ManagementActor command surface, both left as follow-ups by the 2026-05-11
design plans.

(1) area move. AreaService.MoveAreaAsync had existed since the deployment
topology page shipped but was reachable only from the Blazor UI. Adds
MoveAreaCommand(AreaId, NewParentAreaId?) to Commons, a ManagementActor
dispatch arm delegating straight to AreaService.MoveAreaAsync (not-found /
self-parent / descendant-cycle / cross-site / name-collision all surface as
the standard curated ManagementCommandException failure response; the service
writes its own "Move" audit row), and the CLI verb `site area move --id
[--parent-id]`. Omitting --parent-id moves the area to the site root, matching
the command's nullable NewParentAreaId. The command carries the SAME any-of
[Designer, Deployer] gate as CreateArea/UpdateArea/DeleteArea (arch-review C6):
re-parenting is the same structural authoring act, exposed on the same two
surfaces. Placed under the existing `site area` group rather than a new
top-level `area` group, alongside its create/update/delete siblings.

(2) template folder verbs. The five folder management commands have been
handled by ManagementActor since the folder-hierarchy plan, but the promised
CLI surface was never written. Adds `template folder
list|create|rename|move|reorder|delete` mapping 1:1 onto ListTemplateFolders /
CreateTemplateFolder / RenameTemplateFolder / MoveTemplateFolder /
ReorderTemplateFolder / DeleteTemplateFolder. --parent-id is omitted to target
the tree root; --direction takes the lowercase literals up/down, validated at
parse time by AcceptOnlyFromAmong (same case-sensitive contract as the audit
--channel/--kind/--status options).

Follow-on updates: the frozen authorization matrix gains its MoveArea entry
(reflection-driven, so a missing entry would have failed CI); CommandTreeTests
pins both new verb sets plus the omit-parent-id-means-root parse behaviour and
registry round-trips; ManagementActorTests covers the MoveArea role gate and
the delegate-to-service success/root/cycle/not-found paths; the CLI README and
Component-ManagementService.md document the new surface (the latter also gained
the previously-undocumented ReorderTemplateFolder); both plan docs' follow-up
lines are marked done.

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/ManagementActorTests.cs

@@ -3429,6 +3429,99 @@ public class ManagementActorTests : TestKit, IDisposable
         ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
     }
 
+    // ========================================================================
+    // MoveArea (CLI/management parity follow-up from the deployment-topology
+    // plan): re-parenting is the same structural authoring act as create /
+    // update / delete, so it carries the identical any-of [Designer, Deployer]
+    // gate, and every validation rule is delegated to AreaService.MoveAreaAsync.
+    // ========================================================================
+
+    [Theory]
+    [InlineData("Designer")]
+    [InlineData("Deployer")]
+    public void MoveArea_DesignerOrDeployer_Allowed(string role)
+    {
+        var actor = CreateActor();
+        actor.Tell(Envelope(new MoveAreaCommand(1, 2), role));
+        var resp = ExpectMsg<object>(TimeSpan.FromSeconds(5));
+        Assert.IsNotType<ManagementUnauthorized>(resp);
+    }
+
+    [Fact]
+    public void MoveArea_ViewerOnly_Unauthorized()
+    {
+        var actor = CreateActor();
+        actor.Tell(Envelope(new MoveAreaCommand(1, 2), "Viewer"));
+        ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
+    }
+
+    [Fact]
+    public void MoveArea_ToNewParent_ReturnsSuccessAndReparentsArea()
+    {
+        _services.AddScoped<AreaService>();
+        var moving = new Area("Line1") { Id = 3, SiteId = 1, ParentAreaId = 1 };
+        var target = new Area("Building2") { Id = 2, SiteId = 1 };
+        _templateRepo.GetAreaByIdAsync(3, Arg.Any<CancellationToken>()).Returns(moving);
+        _templateRepo.GetAreaByIdAsync(2, Arg.Any<CancellationToken>()).Returns(target);
+        _templateRepo.GetAreasBySiteIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<Area> { new("Building1") { Id = 1, SiteId = 1 }, target, moving });
+
+        var actor = CreateActor();
+        var envelope = Envelope(new MoveAreaCommand(3, 2), "Deployer");
+        actor.Tell(envelope);
+
+        var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+        Assert.Equal(envelope.CorrelationId, response.CorrelationId);
+        Assert.Equal(2, moving.ParentAreaId);
+    }
+
+    [Fact]
+    public void MoveArea_WithNullParent_MovesToSiteRoot()
+    {
+        _services.AddScoped<AreaService>();
+        var moving = new Area("Line1") { Id = 3, SiteId = 1, ParentAreaId = 1 };
+        _templateRepo.GetAreaByIdAsync(3, Arg.Any<CancellationToken>()).Returns(moving);
+        _templateRepo.GetAreasBySiteIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<Area> { new("Building1") { Id = 1, SiteId = 1 }, moving });
+
+        var actor = CreateActor();
+        actor.Tell(Envelope(new MoveAreaCommand(3, null), "Designer"));
+
+        ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+        Assert.Null(moving.ParentAreaId);
+    }
+
+    [Fact]
+    public void MoveArea_UnderOwnDescendant_ReturnsError()
+    {
+        _services.AddScoped<AreaService>();
+        var parent = new Area("Building1") { Id = 1, SiteId = 1 };
+        var child = new Area("Line1") { Id = 2, SiteId = 1, ParentAreaId = 1 };
+        _templateRepo.GetAreaByIdAsync(1, Arg.Any<CancellationToken>()).Returns(parent);
+        _templateRepo.GetAreaByIdAsync(2, Arg.Any<CancellationToken>()).Returns(child);
+        _templateRepo.GetAreasBySiteIdAsync(1, Arg.Any<CancellationToken>())
+            .Returns(new List<Area> { parent, child });
+
+        var actor = CreateActor();
+        actor.Tell(Envelope(new MoveAreaCommand(1, 2), "Designer"));
+
+        var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
+        Assert.Contains("descendants", response.Error, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void MoveArea_AreaNotFound_ReturnsError()
+    {
+        _services.AddScoped<AreaService>();
+        _templateRepo.GetAreaByIdAsync(99, Arg.Any<CancellationToken>()).Returns((Area?)null);
+
+        var actor = CreateActor();
+        actor.Tell(Envelope(new MoveAreaCommand(99, null), "Designer"));
+
+        var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
+        Assert.Contains("99", response.Error);
+    }
+
     // ========================================================================
     // Remote-query actor dispatch for the OPC UA design-time commands
     // (arch-review C4): BrowseNode / SearchAddressSpace / VerifyEndpoint gain