feat(alerts): AdminUI alarm ack/shelve via AdminOperationsActor singleton

T21: add an AdminUI path for acknowledging/shelving alarms that routes
through the admin-pinned AdminOperationsActor cluster singleton, which
republishes onto the same 'alarm-commands' DPS topic the OPC UA method
path (T18) and the engine subscriber (T19) use. The broadcast + the
ScriptedAlarmHostActor ownership filter handle cross-node routing, so
the singleton needs no knowledge of which node owns the alarm.

- Commons: AcknowledgeAlarmCommand/ShelveAlarmCommand (+ result records)
  and a shared AlarmCommandsTopic const; ScriptedAlarmHostActor now
  re-exports that const (mirrors the DriverControlTopic pattern).
- AdminOperationsActor: two handlers map the control-plane messages to
  AlarmCommand (Acknowledge / OneShotShelve / TimedShelve / Unshelve,
  threading User/Comment/UnshelveAtUtc) and publish via the DPS mediator.
- IAdminOperationsClient + AdminOperationsClient: typed Acknowledge/Shelve
  ask wrappers mirroring StartDeploymentAsync.
- Alerts.razor: per-row DriverOperator-gated Ack/Shelve/Unshelve controls;
  operator name from AuthenticationState. Timed-shelve datetime UI deferred.
- 5 TestKit tests (mediator-probe subscribed to alarm-commands) verifying
  each kind's mapping + reply; 56/56 ControlPlane tests green.

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmHostActor.cs

@@ -61,8 +61,10 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
     /// <summary>The cluster DistributedPubSub topic inbound OPC UA Part 9 alarm method calls
     /// (Acknowledge / Confirm / Shelve / AddComment) are routed onto as <see cref="AlarmCommand"/>s.
     /// The OPC UA node manager's condition handlers build the command (after the <c>AlarmAck</c> role
-    /// gate); the host's boot wiring publishes it here; T19's engine-side subscriber consumes it.</summary>
-    public const string AlarmCommandsTopic = "alarm-commands";
+    /// gate, T18) or the AdminUI path republishes via <c>AdminOperationsActor</c> (T21); this host's
+    /// boot wiring subscribes; T19's engine-side handler consumes it. Re-exports the single Commons
+    /// const so every publisher/subscriber shares one literal.</summary>
+    public const string AlarmCommandsTopic = ZB.MOM.WW.OtOpcUa.Commons.OpcUa.AlarmCommandsTopic.Name;
 
     /// <summary>Reconcile the loaded alarm set to exactly the enabled subset of <paramref name="Plans"/>:
     /// builds <see cref="ScriptedAlarmDefinition"/>s (skipping disabled plans), reloads the engine, and