feat(auth)!: ScadaBridge canonical roles + SoD collapse (Audit→Administrator, AuditReadOnly→Viewer) + config-DB migration (Task 1.7)

Standardize role string VALUES on the canonical vocabulary
(Administrator/Designer/Deployer/Viewer; Operator/Engineer unused here):
  Admin        -> Administrator
  Design       -> Designer
  Deployment   -> Deployer
  Audit        -> Administrator   (COLLAPSE; accepted privilege escalation)
  AuditReadOnly-> Viewer          (COLLAPSE; keeps audit-read, no export)

SoD: OperationalAuditRoles = { Administrator, Viewer },
     AuditExportRoles      = { Administrator }
so Viewer reads the audit log + nav but cannot bulk-export, while
Administrator does both + holds the full admin surface (the documented,
accepted auditor/admin SoD collapse).

Atomic move across every enforcement site:
- Roles constants; AuthorizationPolicies (RequireClaim values + SoD arrays +
  honest XML-doc); RoleMapper Deployer check.
- ManagementActor.GetRequiredRole switch + the hard-coded site-scope
  admin-bypass (now Roles.Administrator at all 6 sites). Site-scoping logic
  is otherwise unchanged.
- DebugStreamHub Administrator/Deployer gates (Deployer kept case-sensitive).
- CentralUI BrowseService/BindingTester Designer guards; LdapMappingForm
  dropdown now offers canonical values (incl. Viewer).
- Config-DB seed (LdapGroupMappings Id 1-4) + EF migration CanonicalizeRoles:
  Id-keyed UpdateData for seed rows + idempotent raw catch-all UPDATEs for
  operator-added rows. Down is lossy on the collapse (documented in-file).
  No pending model changes.

Tests reworked to the collapsed model across Security/CentralUI/
ManagementService/ConfigurationDatabase/Integration suites, incl. explicit
Viewer-reads-not-exports and former-Audit-now-Administrator-escalation cases.

CHANGELOG: BREAKING security note documenting the canonicalization + SoD
collapse.

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Auth/SiteScopeServiceTests.cs

@@ -37,7 +37,7 @@ public class SiteScopeServiceTests
     [Fact]
     public async Task DeploymentUserWithNoSiteClaims_IsSystemWide()
     {
-        var svc = ForUser(Role("Deployment"));
+        var svc = ForUser(Role("Deployer"));
 
         Assert.True(await svc.IsSystemWideAsync());
         Assert.Empty(await svc.PermittedSiteIdsAsync());
@@ -46,7 +46,7 @@ public class SiteScopeServiceTests
     [Fact]
     public async Task SystemWideUser_FilterSites_ReturnsAllSites()
     {
-        var svc = ForUser(Role("Deployment"));
+        var svc = ForUser(Role("Deployer"));
 
         var filtered = await svc.FilterSitesAsync(Sites(1, 2, 3));
 
@@ -57,7 +57,7 @@ public class SiteScopeServiceTests
     public async Task ScopedUser_FilterSites_ReturnsOnlyPermittedSites()
     {
         // Regression: a Deployment user scoped to sites 1 and 3 must NOT see site 2.
-        var svc = ForUser(Role("Deployment"), SiteClaim(1), SiteClaim(3));
+        var svc = ForUser(Role("Deployer"), SiteClaim(1), SiteClaim(3));
 
         var filtered = await svc.FilterSitesAsync(Sites(1, 2, 3, 4));
 
@@ -67,7 +67,7 @@ public class SiteScopeServiceTests
     [Fact]
     public async Task ScopedUser_IsSiteAllowed_OnlyForGrantedSites()
     {
-        var svc = ForUser(Role("Deployment"), SiteClaim(5));
+        var svc = ForUser(Role("Deployer"), SiteClaim(5));
 
         Assert.True(await svc.IsSiteAllowedAsync(5));
         Assert.False(await svc.IsSiteAllowedAsync(6));
@@ -76,7 +76,7 @@ public class SiteScopeServiceTests
     [Fact]
     public async Task ScopedUser_IsNotSystemWide_AndReportsItsPermittedIds()
     {
-        var svc = ForUser(Role("Deployment"), SiteClaim(7), SiteClaim(9));
+        var svc = ForUser(Role("Deployer"), SiteClaim(7), SiteClaim(9));
 
         Assert.False(await svc.IsSystemWideAsync());
         Assert.Equal(new[] { 7, 9 }, (await svc.PermittedSiteIdsAsync()).OrderBy(x => x));
@@ -85,7 +85,7 @@ public class SiteScopeServiceTests
     [Fact]
     public async Task SystemWideUser_IsSiteAllowed_ForAnySite()
     {
-        var svc = ForUser(Role("Deployment"));
+        var svc = ForUser(Role("Deployer"));
 
         Assert.True(await svc.IsSiteAllowedAsync(1));
         Assert.True(await svc.IsSiteAllowedAsync(999));