feat(auth): OtOpcUa adopt ZbClaimTypes + ZbCookieDefaults, keep cookie name (Task 1.5)

Add ZB.MOM.WW.Auth.AspNetCore package ref to Security project (version 0.1.1
from central PM). Alias JwtTokenService.UsernameClaimType and DisplayNameClaimType
to ZbClaimTypes.Username ("zb:username") and ZbClaimTypes.DisplayName ("zb:displayname")
so every mint/read site inherits the canonical spelling. AuthEndpoints login path now
emits ZbClaimTypes.Name (= ClaimTypes.Name, populates Identity.Name) instead of
ClaimTypes.NameIdentifier (no other read site used it), and references ZbClaimTypes.Role
(= ClaimTypes.Role) for role claims so [Authorize(Roles=...)] continues to resolve.
Cookie hardening now flows through ZbCookieDefaults.Apply (sets HttpOnly, SameSite=Strict,
SlidingExpiration, SecurePolicy, ExpireTimeSpan) followed by opts.Cookie.Name = v.Name to
preserve the OtOpcUa-specific "ZB.MOM.WW.OtOpcUa.Auth" cookie name. Two new tests added
to AuthEndpointsIntegrationTests assert canonical ZbClaimTypes on the cookie principal and
canonical zb: keys in the JWT payload; all 35 security tests green.

src/Server/ZB.MOM.WW.OtOpcUa.Security/Endpoints/AuthEndpoints.cs

@@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.Auth.AspNetCore;
 using ZB.MOM.WW.Auth.Abstractions.Roles;
 using ZB.MOM.WW.OtOpcUa.Security.Jwt;
 using ZB.MOM.WW.OtOpcUa.Security.Ldap;
@@ -116,12 +117,14 @@ public static class AuthEndpoints
 
         var claims = new List<Claim>
         {
-            new(ClaimTypes.NameIdentifier, result.Username ?? username),
-            new(JwtTokenService.UsernameClaimType, result.Username ?? username),
-            new(JwtTokenService.DisplayNameClaimType, result.DisplayName ?? username),
+            // ZbClaimTypes.Name = ClaimTypes.Name — populates Identity.Name canonically.
+            new(ZbClaimTypes.Name, result.Username ?? username),
+            new(ZbClaimTypes.Username, result.Username ?? username),
+            new(ZbClaimTypes.DisplayName, result.DisplayName ?? username),
         };
         foreach (var role in roles)
-            claims.Add(new Claim(ClaimTypes.Role, role));
+            // ZbClaimTypes.Role = ClaimTypes.Role — framework [Authorize(Roles=...)] + IsInRole work.
+            claims.Add(new Claim(ZbClaimTypes.Role, role));
 
         var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
         var principal = new ClaimsPrincipal(identity);
@@ -157,7 +160,7 @@ public static class AuthEndpoints
                        ?? user.Identity?.Name
                        ?? string.Empty;
         var displayName = user.FindFirst(JwtTokenService.DisplayNameClaimType)?.Value ?? username;
-        var roles = user.FindAll(ClaimTypes.Role).Select(c => c.Value).ToArray();
+        var roles = user.FindAll(ZbClaimTypes.Role).Select(c => c.Value).ToArray();
 
         return Results.Ok(new TokenResponse(jwt.Issue(displayName, username, roles)));
     }