feat(auth)!: ScadaBridge canonical roles + SoD collapse (Audit→Administrator, AuditReadOnly→Viewer) + config-DB migration (Task 1.7)

Standardize role string VALUES on the canonical vocabulary
(Administrator/Designer/Deployer/Viewer; Operator/Engineer unused here):
  Admin        -> Administrator
  Design       -> Designer
  Deployment   -> Deployer
  Audit        -> Administrator   (COLLAPSE; accepted privilege escalation)
  AuditReadOnly-> Viewer          (COLLAPSE; keeps audit-read, no export)

SoD: OperationalAuditRoles = { Administrator, Viewer },
     AuditExportRoles      = { Administrator }
so Viewer reads the audit log + nav but cannot bulk-export, while
Administrator does both + holds the full admin surface (the documented,
accepted auditor/admin SoD collapse).

Atomic move across every enforcement site:
- Roles constants; AuthorizationPolicies (RequireClaim values + SoD arrays +
  honest XML-doc); RoleMapper Deployer check.
- ManagementActor.GetRequiredRole switch + the hard-coded site-scope
  admin-bypass (now Roles.Administrator at all 6 sites). Site-scoping logic
  is otherwise unchanged.
- DebugStreamHub Administrator/Deployer gates (Deployer kept case-sensitive).
- CentralUI BrowseService/BindingTester Designer guards; LdapMappingForm
  dropdown now offers canonical values (incl. Viewer).
- Config-DB seed (LdapGroupMappings Id 1-4) + EF migration CanonicalizeRoles:
  Id-keyed UpdateData for seed rows + idempotent raw catch-all UPDATEs for
  operator-added rows. Down is lossy on the collapse (documented in-file).
  No pending model changes.

Tests reworked to the collapsed model across Security/CentralUI/
ManagementService/ConfigurationDatabase/Integration suites, incl. explicit
Viewer-reads-not-exports and former-Audit-now-Administrator-escalation cases.

CHANGELOG: BREAKING security note documenting the canonicalization + SoD
collapse.

src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs

@@ -26,8 +26,8 @@ public class DebugStreamHub : Hub
     /// Pure site-scope authorization check for a debug-stream subscription.
     /// Returns true when the caller may subscribe to a debug stream for an instance
     /// belonging to <paramref name="instanceSiteId"/>.
-    /// Admin role, or an empty <paramref name="permittedSiteIds"/> (system-wide
-    /// Deployment), grants access to any site; otherwise the instance's site must be
+    /// Administrator role, or an empty <paramref name="permittedSiteIds"/> (system-wide
+    /// Deployer), grants access to any site; otherwise the instance's site must be
     /// in the permitted set.
     /// </summary>
     /// <param name="roles">Roles held by the connected user.</param>
@@ -38,7 +38,7 @@ public class DebugStreamHub : Hub
         IReadOnlyCollection<string> permittedSiteIds,
         int instanceSiteId)
     {
-        if (roles.Contains("Admin", StringComparer.OrdinalIgnoreCase)) return true;
+        if (roles.Contains(Roles.Administrator, StringComparer.OrdinalIgnoreCase)) return true;
         if (permittedSiteIds.Count == 0) return true; // system-wide deployment
         return permittedSiteIds.Contains(instanceSiteId.ToString());
     }
@@ -109,13 +109,13 @@ public class DebugStreamHub : Hub
             return;
         }
 
-        // Role check — Deployment role required
+        // Role check — Deployer role required
         var roleMapper = httpContext.RequestServices.GetRequiredService<RoleMapper>();
         var mappingResult = await roleMapper.MapGroupsToRolesAsync(authResult.Groups, Context.ConnectionAborted);
 
-        if (!mappingResult.Roles.Contains("Deployment"))
+        if (!mappingResult.Roles.Contains(Roles.Deployer))
         {
-            _logger.LogWarning("DebugStreamHub connection rejected: {Username} lacks Deployment role", username);
+            _logger.LogWarning("DebugStreamHub connection rejected: {Username} lacks Deployer role", username);
             Context.Abort();
             return;
         }