feat(auth)!: ScadaBridge canonical roles + SoD collapse (Audit→Administrator, AuditReadOnly→Viewer) + config-DB migration (Task 1.7)

Standardize role string VALUES on the canonical vocabulary
(Administrator/Designer/Deployer/Viewer; Operator/Engineer unused here):
  Admin        -> Administrator
  Design       -> Designer
  Deployment   -> Deployer
  Audit        -> Administrator   (COLLAPSE; accepted privilege escalation)
  AuditReadOnly-> Viewer          (COLLAPSE; keeps audit-read, no export)

SoD: OperationalAuditRoles = { Administrator, Viewer },
     AuditExportRoles      = { Administrator }
so Viewer reads the audit log + nav but cannot bulk-export, while
Administrator does both + holds the full admin surface (the documented,
accepted auditor/admin SoD collapse).

Atomic move across every enforcement site:
- Roles constants; AuthorizationPolicies (RequireClaim values + SoD arrays +
  honest XML-doc); RoleMapper Deployer check.
- ManagementActor.GetRequiredRole switch + the hard-coded site-scope
  admin-bypass (now Roles.Administrator at all 6 sites). Site-scoping logic
  is otherwise unchanged.
- DebugStreamHub Administrator/Deployer gates (Deployer kept case-sensitive).
- CentralUI BrowseService/BindingTester Designer guards; LdapMappingForm
  dropdown now offers canonical values (incl. Viewer).
- Config-DB seed (LdapGroupMappings Id 1-4) + EF migration CanonicalizeRoles:
  Id-keyed UpdateData for seed rows + idempotent raw catch-all UPDATEs for
  operator-added rows. Down is lossy on the collapse (documented in-file).
  No pending model changes.

Tests reworked to the collapsed model across Security/CentralUI/
ManagementService/ConfigurationDatabase/Integration suites, incl. explicit
Viewer-reads-not-exports and former-Audit-now-Administrator-escalation cases.

CHANGELOG: BREAKING security note documenting the canonicalization + SoD
collapse.

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/ApiKeyCreationTests.cs

@@ -18,7 +18,7 @@ namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
 /// the seam (the real <c>LibraryInboundApiKeyAdmin</c> + SQLite mapping is covered end-to-end
 /// by the Security project's <c>LibraryInboundApiKeyAdminTests</c>). They verify the actor's
 /// dispatch, response shapes (string keyId, one-time token, methods), the preserved ScadaBridge
-/// management-audit calls, and that the "Admin" role gate still applies to all five commands.
+/// management-audit calls, and that the "Administrator" role gate still applies to all five commands.
 /// </summary>
 public class ApiKeyCreationTests : TestKit, IDisposable
 {
@@ -48,7 +48,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void CreateApiKey_ReturnsKeyIdAndOneTimeToken()
     {
         var actor = CreateActor();
-        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", new[] { "MethodA", "MethodB" }), "Admin"));
+        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", new[] { "MethodA", "MethodB" }), "Administrator"));
 
         var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
@@ -73,7 +73,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void CreateApiKey_AuditsTheCreate()
     {
         var actor = CreateActor();
-        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", new[] { "MethodA" }), "Admin"));
+        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", new[] { "MethodA" }), "Administrator"));
         ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
         _auditService.Received(1).LogAsync(
@@ -84,7 +84,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void CreateApiKey_ResponseDoesNotEchoAHash()
     {
         var actor = CreateActor();
-        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", new[] { "MethodA" }), "Admin"));
+        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", new[] { "MethodA" }), "Administrator"));
 
         var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
@@ -100,7 +100,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
         _admin.Seed("key-2", "Service B", enabled: false, "M3");
 
         var actor = CreateActor();
-        actor.Tell(Envelope(new ListApiKeysCommand(), "Admin"));
+        actor.Tell(Envelope(new ListApiKeysCommand(), "Administrator"));
 
         var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
@@ -125,7 +125,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
         _admin.Seed("key-1", "Service A", enabled: true, "M1");
 
         var actor = CreateActor();
-        actor.Tell(Envelope(new UpdateApiKeyCommand("key-1", false), "Admin"));
+        actor.Tell(Envelope(new UpdateApiKeyCommand("key-1", false), "Administrator"));
 
         var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
@@ -145,7 +145,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
         _admin.Seed("key-1", "Service A", enabled: true, "M1");
 
         var actor = CreateActor();
-        actor.Tell(Envelope(new DeleteApiKeyCommand("key-1"), "Admin"));
+        actor.Tell(Envelope(new DeleteApiKeyCommand("key-1"), "Administrator"));
 
         var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
@@ -162,7 +162,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
         _admin.Seed("key-1", "Service A", enabled: true, "Old1", "Old2");
 
         var actor = CreateActor();
-        actor.Tell(Envelope(new SetApiKeyMethodsCommand("key-1", new[] { "New1", "New2", "New3" }), "Admin"));
+        actor.Tell(Envelope(new SetApiKeyMethodsCommand("key-1", new[] { "New1", "New2", "New3" }), "Administrator"));
 
         var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
 
@@ -188,7 +188,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     {
         // No keys seeded — "key-unknown" does not exist.
         var actor = CreateActor();
-        actor.Tell(Envelope(new UpdateApiKeyCommand("key-unknown", false), "Admin"));
+        actor.Tell(Envelope(new UpdateApiKeyCommand("key-unknown", false), "Administrator"));
 
         var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
 
@@ -202,7 +202,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void SetApiKeyMethods_UnknownKey_ReturnsManagementError_AndDoesNotAudit()
     {
         var actor = CreateActor();
-        actor.Tell(Envelope(new SetApiKeyMethodsCommand("key-unknown", new[] { "M1" }), "Admin"));
+        actor.Tell(Envelope(new SetApiKeyMethodsCommand("key-unknown", new[] { "M1" }), "Administrator"));
 
         var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
 
@@ -215,7 +215,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void DeleteApiKey_UnknownKey_ReturnsManagementError_AndDoesNotAudit()
     {
         var actor = CreateActor();
-        actor.Tell(Envelope(new DeleteApiKeyCommand("key-unknown"), "Admin"));
+        actor.Tell(Envelope(new DeleteApiKeyCommand("key-unknown"), "Administrator"));
 
         var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
 
@@ -232,7 +232,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void CreateApiKey_EmptyMethods_ReturnsManagementError()
     {
         var actor = CreateActor();
-        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", Array.Empty<string>()), "Admin"));
+        actor.Tell(Envelope(new CreateApiKeyCommand("MES-Production", Array.Empty<string>()), "Administrator"));
 
         var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
 
@@ -249,7 +249,7 @@ public class ApiKeyCreationTests : TestKit, IDisposable
         _admin.Seed("key-1", "Service A", enabled: true, "M1");
 
         var actor = CreateActor();
-        actor.Tell(Envelope(new SetApiKeyMethodsCommand("key-1", Array.Empty<string>()), "Admin"));
+        actor.Tell(Envelope(new SetApiKeyMethodsCommand("key-1", Array.Empty<string>()), "Administrator"));
 
         var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
 
@@ -265,11 +265,11 @@ public class ApiKeyCreationTests : TestKit, IDisposable
     public void EveryApiKeyCommand_RequiresAdminRole(object command)
     {
         var actor = CreateActor();
-        // A Design-role caller (not Admin) must be rejected for every API-key command.
-        actor.Tell(Envelope(command, "Design"));
+        // A Designer-role caller (not Administrator) must be rejected for every API-key command.
+        actor.Tell(Envelope(command, "Designer"));
 
         var response = ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
-        Assert.Contains("Admin", response.Message);
+        Assert.Contains("Administrator", response.Message);
     }
 
     public static IEnumerable<object[]> AllApiKeyCommands() => new[]