Merge R2-05 AdminUI authorization (arch-review round 2) [PR #428]

Finding 04/C-1 (High): explicit named-policy gating on all 38 AdminUI pages via
new AdminUiPolicies (ConfigEditor + AuthenticatedRead) + anti-drift reflection
guard. T15 live pass deferred (docker-dev auto-admin can't observe deny).
STATUS.md conflict resolved additively. Build clean.

CLAUDE.md

@@ -220,8 +220,9 @@ help, document formatting, and tag-path completions inside `ctx.GetTag("…")` /
 runtime publish gate uses, so what the editor accepts/rejects matches publish
 exactly. The backend lives in
 `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/` (six minimal-API
-endpoints under `/api/script-analysis/*`, gated to the `Administrator,Designer`
-roles via `RequireAuthorization` in `ScriptAnalysisEndpoints.MapScriptAnalysis`).
+endpoints under `/api/script-analysis/*`, gated by the `ConfigEditor` policy
+(Administrator or Designer) via `RequireAuthorization` in
+`ScriptAnalysisEndpoints.MapScriptAnalysisEndpoints`).
 See `docs/ScriptEditor.md` for the full guide. Scripts may use the `{{equip}}` token for equipment-relative tag paths that resolve per-equipment at deploy time — see the "Equipment-relative tag paths" section in `docs/ScriptEditor.md`.
 
 ## Scripted Alarm Ack/Shelve