fix(tagconfig): close the four #551 residuals — accept-gate-first Inspect, three authoring rules, CSV/service gate, doc sweep

Gitea #551.

1. CSV import ran no driver-typed config gate. Its typed columns were always
   strictly parsed, but the free-form TagConfigJson column reached the database
   unread, so a CSV could author a tag the driver rejects — one that deploys
   green and reads BadNodeIdUnknown forever. RawTagCsvMapper.Parse now names the
   offending row in the staged review grid, and RawTreeService enforces the same
   gate on CreateTag/UpdateTag/ImportTags: a form cannot be the guarantee (the
   API and any future caller reach none of them, and this repo has no bUnit).
   A rejected import row is an ERROR — the batch inserts nothing and the row is
   named — never a skip.

   Note the brief's premise that manual entry rides ImportTagsAsync is wrong:
   RawManualTagEntryModal commits row-by-row via CreateTagAsync, which is why
   the gate had to land on all three write paths.

2/3. The seven pre-#549 Inspect methods ran a hand-list of DescribeInvalidEnum
   checks, so every rejection cause not on the list was invisible. They are now
   ACCEPT-GATE-FIRST (the MTConnect/Sql/OpcUaClient/Calculation shape): ask the
   driver's own reader for the verdict, then explain the refusal, with a
   catch-all so "the parse rejects but Inspect said nothing" is unreachable.
   That closes S7's absent dataType, AbCip members[], Modbus stringByteOrder and
   the type-dependent guards, plus causes the issue did not name (absent
   region/address/tagPath/symbolPath/topic, TwinCAT Structure, MQTT's Sparkplug
   tuple). FOCAS and MQTT keep advisories about ACCEPTED blobs, so they
   diagnose rather than return empty.

   Authoring half: ModbusTagConfigModel gains stringByteOrder;
   AbCipTagConfigModel asks the new AbCipTagDefinitionFactory.DescribeInvalidMember;
   S7TagConfigModel captures whether the SOURCE blob declared dataType and asks
   S7TagDefinitionFactory.DataTypeKey/DeclaresDataType. One authority per rule.

4. Doc sweep: the six factory Inspect summaries, EquipmentTagConfigInspector's
   class remarks and AdminOperationsActor's comment all claimed invalid enums are
   "silently defaulted by the lenient runtime" — false since R2-11 Phase C made
   the runtime reads strict. They describe rejections now.

src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/AdminOperations/AdminOperationsActor.cs

@@ -246,8 +246,11 @@ public sealed class AdminOperationsActor : ReceiveActor
             }
 
             // R2-11 (05/CONV-2): deploy-time TagConfig strictness inspection over equipment tags. The
-            // driver-typed EquipmentTagConfigInspector surfaces present-but-invalid enum values (which the
-            // lenient runtime silently defaults) + structurally-unparseable TagConfig. In Warn mode
+            // driver-typed EquipmentTagConfigInspector surfaces every blob the driver's own reader would
+            // REJECT — a present-but-invalid enum value, an absent or malformed address field, a
+            // structurally-unparseable TagConfig — each of which makes the driver skip the tag so it reads
+            // BadNodeIdUnknown forever. (Pre-R2-11 Phase C the runtime silently defaulted a typo'd enum;
+            // it has rejected the tag since, so these warnings describe rejections.) In Warn mode
             // (default) these are non-blocking (logged + appended to the accepted result Message); in Error
             // mode they fold into the reject list so a typo'd config cannot be re-deployed until fixed.
             // Running servers are untouched either way — the gate only sees re-deploys.

src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/AdminOperations/EquipmentTagConfigInspector.cs

@@ -17,8 +17,17 @@ namespace ZB.MOM.WW.OtOpcUa.ControlPlane.AdminOperations;
 ///     Deploy-time TagConfig inspection dispatched by <c>DriverType</c> (R2-11, 05/CONV-2). Mirrors the
 ///     AdminUI <c>TagConfigValidator</c> shape: a case-insensitive map from the canonical driver-type string
 ///     to that driver's lightweight <c>Contracts</c> parser <c>Inspect()</c>, returning human-readable
-///     warnings (present-but-invalid enum values that the lenient runtime silently defaults, plus
-///     structurally-unparseable TagConfig). Never throws.
+///     warnings. Never throws.
+///     <para><b>The warnings describe REJECTIONS, not silent defaults.</b> Every driver's runtime read has
+///     been strict since R2-11 Phase C (<c>TagConfigJson.TryReadEnumStrict</c>): a present-but-invalid enum
+///     value — like an absent or malformed address field, or an unparseable document — makes the reader
+///     refuse the whole tag, so the driver skips it and it reads <c>BadNodeIdUnknown</c> forever with the
+///     deployment otherwise green. That is what these warnings are for. (Before Phase C the runtime did
+///     silently substitute a default for a typo'd enum; the doc-comments here and on the per-driver
+///     <c>Inspect</c> methods still said so until Gitea #551.) Because a warning can be PROMOTED to a
+///     blocking error by <c>TagConfigValidationMode.Error</c>, each <c>Inspect</c> asks its driver's own
+///     reader for the verdict and only explains a refusal — never restating the rule, and so never able to
+///     be stricter than the runtime it reports on.</para>
 ///     <para><b>Coverage is every driver that ships an <c>Inspect</c>, and that invariant is guarded</b> by
 ///     <c>EquipmentTagConfigInspectorCoverageTests</c>, which reflects over the referenced
 ///     <c>*.Contracts</c> assemblies — so a driver that gains an inspector cannot be silently left out. This