fix(security): first-party JwtBearer with HS256 pinned; /auth/token mints for a cookie session only

The hand-rolled bearer handler is replaced by AddJwtBearer (Microsoft.AspNetCore.Authentication.JwtBearer
10.0.7, pinned on the same servicing line as the other AspNetCore packages). Validation parameters come
from JwtTokenService.BuildValidationParameters, which now pins ValidAlgorithms = HS256 for both the
bearer scheme and TryValidate; MapInboundClaims is off so the minted Role/zb:username keys resolve.
/auth/token requires the cookie scheme, so a bearer can no longer mint a fresh token for itself.

Refs #733
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/JwtConfigurationGateTests.cs

@@ -65,7 +65,7 @@ public sealed class JwtConfigurationGateTests
         var schemes = host.Services.GetRequiredService<IAuthenticationSchemeProvider>();
         var bearer = await schemes.GetSchemeAsync(OtOpcUaAuthSchemes.Bearer);
         bearer.ShouldNotBeNull();
-        bearer.HandlerType.ShouldBe(typeof(JwtBearerAuthenticationHandler));
+        bearer.HandlerType.ShouldBe(typeof(Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler));
         await host.StopAsync(Ct);
     }