feat(mesh): CentralCommandService on the ConfigServe listener

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -744,6 +744,16 @@ if (hasDriver && syncListenPort > 0)
 if (hasAdmin && configServeGrpcPort > 0)
 {
     app.MapGrpcService<DeploymentArtifactGrpcService>();
+
+    // Central command ingress (ClusterClient→gRPC migration): the node→central deployment ack. It
+    // rides the SAME listener rather than claiming a port of its own — a second cleartext h2c port
+    // would buy nothing but another firewall rule, and both endpoints are admin-role and dialled by
+    // the same driver nodes. Deliberately NOT gated on MeshTransport:Mode: mapping it under Dps
+    // costs nothing (nothing dials it) whereas gating it would mean flipping the mode on a running
+    // fleet requires a central restart before any node can ack — the same reasoning that registers
+    // CentralCommunicationActor in both modes. CentralCommandAuthInterceptor (added at AddGrpc
+    // above) is the ONLY inbound auth and fail-closes per cluster.
+    app.MapGrpcService<CentralCommandGrpcService>();
 }
 
 // Driver-node live-telemetry stream (per-cluster mesh Phase 5). Central dials in; gated by