feat(alerts): AdminUI alarm ack/shelve via AdminOperationsActor singleton

T21: add an AdminUI path for acknowledging/shelving alarms that routes
through the admin-pinned AdminOperationsActor cluster singleton, which
republishes onto the same 'alarm-commands' DPS topic the OPC UA method
path (T18) and the engine subscriber (T19) use. The broadcast + the
ScriptedAlarmHostActor ownership filter handle cross-node routing, so
the singleton needs no knowledge of which node owns the alarm.

- Commons: AcknowledgeAlarmCommand/ShelveAlarmCommand (+ result records)
  and a shared AlarmCommandsTopic const; ScriptedAlarmHostActor now
  re-exports that const (mirrors the DriverControlTopic pattern).
- AdminOperationsActor: two handlers map the control-plane messages to
  AlarmCommand (Acknowledge / OneShotShelve / TimedShelve / Unshelve,
  threading User/Comment/UnshelveAtUtc) and publish via the DPS mediator.
- IAdminOperationsClient + AdminOperationsClient: typed Acknowledge/Shelve
  ask wrappers mirroring StartDeploymentAsync.
- Alerts.razor: per-row DriverOperator-gated Ack/Shelve/Unshelve controls;
  operator name from AuthenticationState. Timed-shelve datetime UI deferred.
- 5 TestKit tests (mediator-probe subscribed to alarm-commands) verifying
  each kind's mapping + reply; 56/56 ControlPlane tests green.

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Interfaces/IAdminOperationsClient.cs

@@ -15,6 +15,36 @@ public interface IAdminOperationsClient
     /// <returns>A task representing the asynchronous operation containing the deployment start result.</returns>
     Task<StartDeploymentResult> StartDeploymentAsync(string createdBy, CancellationToken ct);
 
+    /// <summary>
+    ///     Acknowledges one alarm via the admin singleton, which republishes the mapped command onto
+    ///     the cluster <c>alarm-commands</c> topic for the owning node to apply.
+    /// </summary>
+    /// <param name="alarmId">The alarm's ScriptedAlarmId.</param>
+    /// <param name="user">The acting operator's name (for audit + the alarm-event User field).</param>
+    /// <param name="comment">Optional free-text comment; null when none.</param>
+    /// <param name="ct">The cancellation token.</param>
+    /// <returns>The acknowledge result.</returns>
+    Task<AcknowledgeAlarmResult> AcknowledgeAlarmAsync(string alarmId, string user, string? comment, CancellationToken ct);
+
+    /// <summary>
+    ///     Shelves or unshelves one alarm via the admin singleton, which republishes the mapped command
+    ///     onto the cluster <c>alarm-commands</c> topic for the owning node to apply.
+    /// </summary>
+    /// <param name="alarmId">The alarm's ScriptedAlarmId.</param>
+    /// <param name="user">The acting operator's name (for audit + the alarm-event User field).</param>
+    /// <param name="kind">Which shelve action to perform (OneShot / Timed / Unshelve).</param>
+    /// <param name="unshelveAtUtc">For <see cref="Messages.Admin.ShelveKind.Timed"/>, when the shelve expires; null otherwise.</param>
+    /// <param name="comment">Optional free-text comment; null when none.</param>
+    /// <param name="ct">The cancellation token.</param>
+    /// <returns>The shelve result.</returns>
+    Task<ShelveAlarmResult> ShelveAlarmAsync(
+        string alarmId,
+        string user,
+        Messages.Admin.ShelveKind kind,
+        DateTime? unshelveAtUtc,
+        string? comment,
+        CancellationToken ct);
+
     /// <summary>
     ///     Generic Ask: forwards <paramref name="message"/> to the AdminOperationsActor
     ///     cluster-singleton proxy and awaits a reply of type <typeparamref name="T"/>.