feat(audit): OtOpcUa IAuditActorAccessor seam + HTTP impl (audit Actor from Auth principal) (Phase 3)

Introduces the IAuditActorAccessor seam and HttpAuditActorAccessor impl so the
ZB.MOM.WW.Audit.AuditEvent Actor field can be sourced from the authenticated Blazor
cookie principal (ZbClaimTypes.Username) when structured emitters are added. Adds the
AuditActor.Resolve static helper (accessor value → SystemFallback/"system") as the
canonical pattern for future emit sites. Wires DI in AddOtOpcUaAuth (TryAddScoped) with
AddHttpContextAccessor(). The structured AuditEvent path remains DORMANT — no live emit
sites exist; seam is forward-looking. SP-based audit path left untouched. 9 new unit
tests all green; Security (54) and ControlPlane (45) test suites fully pass.

src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs

@@ -10,6 +10,7 @@ using Microsoft.Extensions.Options;
 using ZB.MOM.WW.Auth.AspNetCore;
 using ZB.MOM.WW.Auth.Abstractions.Roles;
 using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Security.Audit;
 using ZB.MOM.WW.OtOpcUa.Security.Jwt;
 using ZB.MOM.WW.OtOpcUa.Security.Ldap;
 
@@ -37,6 +38,19 @@ public static class ServiceCollectionExtensions
         services.AddOptions<LdapOptions>().Bind(configuration.GetSection(LdapOptions.SectionName));
 
         services.AddSingleton<JwtTokenService>();
+
+        // IHttpContextAccessor is not registered by default — call AddHttpContextAccessor()
+        // so HttpAuditActorAccessor and any Blazor/minimal-API component that reads the current
+        // HTTP context by injection can resolve it. AddHttpContextAccessor is idempotent (internal
+        // TryAdd), so calling it here is safe even if the host also calls it elsewhere.
+        services.AddHttpContextAccessor();
+
+        // IAuditActorAccessor — resolves the authenticated HTTP principal's actor string for use
+        // as the Actor field when constructing a canonical ZB.MOM.WW.Audit.AuditEvent. Registered
+        // Scoped so it correctly follows the request scope used by Blazor Server and minimal-API
+        // endpoints.
+        services.TryAddScoped<IAuditActorAccessor, HttpAuditActorAccessor>();
+
         // Singleton — OtOpcUaLdapAuthService is stateless (the shared-library directory client it
         // wraps opens/disposes an LdapConnection per call) and must be consumable by the Singleton
         // LdapOpcUaUserAuthenticator on driver-role nodes. This is the app's ILdapAuthService: it