feat(alarms): route inbound Part 9 alarm methods through AlarmAck gate (T18)

Wire the materialised AlarmConditionState method handlers so a client calling
Acknowledge/Confirm/Shelve/AddComment is gated on the AlarmAck data-plane role
and, when allowed, routed back to the scripted-alarm engine via a new
`alarm-commands` DistributedPubSub topic.

- Commons: new AlarmCommand DTO (AlarmId/Operation/User/Comment/UnshelveAtUtc).
- ScriptedAlarmHostActor: add AlarmCommandsTopic const.
- OtOpcUaNodeManager: settable AlarmCommandRouter + wire OnAcknowledge/OnConfirm/
  OnAddComment/OnShelve/OnTimedUnshelve. Each resolves the principal off
  ISessionOperationContext.UserIdentity as RoleCarryingUserIdentity, fails closed
  (BadUserAccessDenied) when the AlarmAck role is absent or no identity, else maps
  + routes an AlarmCommand and returns Good. OnShelve discriminates OneShotShelve/
  TimedShelve/Unshelve from the SDK flags; TimedShelve expiry = UtcNow + ms.
  No Akka/IActorRef handle — only the Action<AlarmCommand> delegate. T20 de-dup
  note left; WriteAlarmCondition untouched.
- OpcUaServer.Security: OpcUaDataPlaneRoles.AlarmAck shared const (the role was a
  bare string everywhere; introduced one symbol for the gate + tests).
- OtOpcUaSdkServer: SetAlarmCommandRouter pass-through.
- Host: boot wiring publishes each command via mediator.Tell(Publish(...)) using a
  lazy ActorSystem accessor (mirrors DpsScriptLogPublisher).
- Tests: 11 new gate + mapping tests (OpcUaServer.Tests 88->99, all green).

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmHostActor.cs

@@ -58,6 +58,12 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
     /// the constant the (retired) <c>ScriptedAlarmActor</c> used so subscribers stay wired.</summary>
     public const string AlertsTopic = "alerts";
 
+    /// <summary>The cluster DistributedPubSub topic inbound OPC UA Part 9 alarm method calls
+    /// (Acknowledge / Confirm / Shelve / AddComment) are routed onto as <see cref="AlarmCommand"/>s.
+    /// The OPC UA node manager's condition handlers build the command (after the <c>AlarmAck</c> role
+    /// gate); the host's boot wiring publishes it here; T19's engine-side subscriber consumes it.</summary>
+    public const string AlarmCommandsTopic = "alarm-commands";
+
     /// <summary>Reconcile the loaded alarm set to exactly the enabled subset of <paramref name="Plans"/>:
     /// builds <see cref="ScriptedAlarmDefinition"/>s (skipping disabled plans), reloads the engine, and
     /// re-registers mux interest for the union of dependency refs.</summary>