feat(security): cookie session idle-timeout + LDAP-free role-mapping refresh (#15, M2.19)

Spike outcome: the shared ILdapAuthService (ZB.MOM.WW.Auth.Abstractions, an external
NuGet package) exposes ONLY AuthenticateAsync(username, password, ct) — no passwordless
service-account group-search. A live LDAP group re-query for an active session therefore
requires a new lib method and is OUT OF SCOPE (cannot modify the external package).
Implemented the always-achievable layers (cookie-only; no embedded JWT for cookie principals):

- /auth/login now stores the user's raw LDAP groups (one zb:group claim each) plus a
  zb:lastrolerefresh anchor (login time, UTC), seeding the LastActivity idle anchor too.
- SessionClaimBuilder: single shared DRY claim-builder used by BOTH /auth/login AND the
  refresh path, so the two claim shapes cannot drift (canonical identity/role/scope claims
  with nameType/roleType pinned, plus the M2.19 group + refresh-anchor additions).
- CookieSessionValidator (TimeProvider-injected, unit-testable) + a thin
  CookieAuthenticationEvents.OnValidatePrincipal adapter:
    * idle-timeout: a session past IdleTimeoutMinutes (default 30) is RejectPrincipal+SignOut;
      consistent with the cookie ExpireTimeSpan+SlidingExpiration window (same value).
    * role refresh WITHOUT LDAP: when older than RoleRefreshThresholdMinutes (new option,
      default 15) the DB-backed RoleMapper re-runs on the STORED groups, claims are rebuilt
      via the shared builder, the anchor advances, principal is replaced + cookie renewed.
      Revoked DB mappings drop the user's roles mid-session.
    * fail-soft: any refresh error KEEPS the existing principal (no sign-out, never throws)
      — mirrors the documented "LDAP failure: active sessions continue with current roles".
- Documented residual limitation in Component-Security.md: central role-mapping/scope
  changes apply within ~15 min without LDAP; live directory group-membership changes are
  picked up only at next login (needs a passwordless group-search on the external
  ZB.MOM.WW.Auth.Ldap lib — tracked follow-up).

Tests (Security.Tests, all green): CookieSessionValidatorTests + SessionClaimBuilderParityTests
— idle reject/keep, LDAP-free remap-from-stored-groups, revoked-roles loss, sub-threshold
no-refresh, refresh-throws-keeps-session, and login/refresh claim-parity.

src/ZB.MOM.WW.ScadaBridge.Security/SecurityOptions.cs

@@ -35,6 +35,20 @@ public class SecurityOptions
     /// </summary>
     public int JwtRefreshThresholdMinutes { get; set; } = 5;
 
+    /// <summary>
+    /// M2.19 (#15): how long a cookie session's role-mapping projection may be stale
+    /// before <c>OnValidatePrincipal</c> re-runs the DB-backed <c>RoleMapper</c> on the
+    /// session's stored LDAP group claims and rebuilds the role/scope claims (default
+    /// <b>15 minutes</b>, matching the documented sliding-refresh cadence). This is a
+    /// purely central (database) refresh — it picks up LDAP-group→role mapping changes
+    /// and scope-rule changes WITHOUT contacting LDAP, so revoked roles take effect
+    /// within this window. It does NOT pick up live LDAP group-membership changes (the
+    /// shared LDAP library exposes no passwordless group-search; that remains a
+    /// next-login refresh — see Component-Security.md). Kept &lt;= the cookie idle
+    /// window so a refresh never outlives the session it refreshes.
+    /// </summary>
+    public int RoleRefreshThresholdMinutes { get; set; } = 15;
+
     /// <summary>
     /// When true (default) the authentication cookie is always marked
     /// <c>Secure</c> (sent only over HTTPS) — the correct production setting,