feat(security): add Operator + Verifier roles + policies + LDAP mapping options (T14a)

src/ZB.MOM.WW.ScadaBridge.Security/AuthorizationPolicies.cs

@@ -74,6 +74,21 @@ public static class AuthorizationPolicies
     public const string RequireDesign = "RequireDesign";
     public const string RequireDeployment = "RequireDeployment";
 
+    /// <summary>
+    /// Permission to initiate a two-person Secured Write (M7-A3 / T14a).
+    /// Satisfied by the <see cref="Roles.Operator"/> role claim. Single-role
+    /// policy mirroring <see cref="RequireAdmin"/>.
+    /// </summary>
+    public const string RequireOperator = "RequireOperator";
+
+    /// <summary>
+    /// Permission to approve a two-person Secured Write (M7-A3 / T14a).
+    /// Satisfied by the <see cref="Roles.Verifier"/> role claim. Kept distinct
+    /// from <see cref="RequireOperator"/> so initiation and approval are
+    /// separable duties.
+    /// </summary>
+    public const string RequireVerifier = "RequireVerifier";
+
     /// <summary>
     /// Read access to the Audit Log #23 surface (Audit Log page,
     /// Configuration Audit Log page, Audit nav group). Granted to the
@@ -135,6 +150,12 @@ public static class AuthorizationPolicies
             options.AddPolicy(RequireDeployment, policy =>
                 policy.RequireClaim(JwtTokenService.RoleClaimType, Roles.Deployer));
 
+            options.AddPolicy(RequireOperator, policy =>
+                policy.RequireClaim(JwtTokenService.RoleClaimType, Roles.Operator));
+
+            options.AddPolicy(RequireVerifier, policy =>
+                policy.RequireClaim(JwtTokenService.RoleClaimType, Roles.Verifier));
+
             // Multi-role permission policies — the policy succeeds when the
             // principal holds ANY of the mapped roles. RequireClaim with
             // multiple allowed values is the right primitive: it checks