review(AdminUI): fix null-TagConfig crash, CTS leak, unencoded historian tag

Review at HEAD 7286d320. AdminUI-002: IsValidJson null/blank -> friendly error (was
ArgumentNullException). AdminUI-003: DriverStatusPanel Reconnect/Restart dispose CTS (build-
verified, live /run deferred). AdminUI-005: HistorianWonderware picker URL-encodes tag name.
AdminUI-008: Format round-trip test. 001 (script-page authz) + 004 (hub [Authorize]) left
Open as cross-cutting w/ Host/Security.

tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/ScriptAnalysis/FormatTests.cs

@@ -27,4 +27,24 @@ public sealed class FormatTests
         var src = "return ctx.GetTag(\"A\").Value;";
         Fmt(src).ShouldNotBeNull();
     }
+
+    // AdminUI-008: lock the documented "return the original on un-formattable input" contract.
+
+    [Fact] public void Format_returns_input_unchanged_for_null_or_empty()
+    {
+        // Null and empty short-circuit before parsing (string.IsNullOrEmpty guard) and round-trip
+        // verbatim — the documented "return the original" contract for non-formattable input.
+        Svc.Format(new FormatRequest(null!)).Code.ShouldBeNull();
+        Fmt("").ShouldBe("");
+    }
+
+    [Fact] public void Format_returns_input_for_unparseable_garbage()
+    {
+        // Deeply malformed input must never throw into the caller — the contract is "return the
+        // original string". Whatever Format returns, it must be non-null and preserve the content
+        // for input the formatter cannot reflow.
+        const string garbage = "@@@ ))) {{{ not csharp at all";
+        var outp = Fmt(garbage);
+        outp.ShouldNotBeNull();
+    }
 }