feat(adminui): F15 Phase A — shell + auth + fleet + hosts pages

Implements Phase A of the F15 rebuild plan: minimum-viable Admin surface
with a working sign-in path and a fleet-state landing page. Decisions Q1–Q5
of docs/v2/AdminUI-rebuild-plan.md were taken as recommended.

- App.razor (moved into AdminUI library from the Host stub; vendored
  Bootstrap from RCL wwwroot — no public CDN, air-gap safe)
- Routes.razor (AuthorizeRouteView enforces page-level [Authorize])
- RedirectToLogin.razor (preserves returnUrl through the auth hop)
- Login.razor (static SSR, posts to /auth/login; Q5 wording about
  generic-vs-specific LDAP errors)
- Account.razor (identity + fleet roles + raw LDAP groups; Q4 — no
  per-cluster grants; fleet-wide LDAP-group → role mapping only)
- Fleet.razor (per-node deployment status: reads NodeDeploymentState
  + unions with IClusterRoleInfo.MembersWithRole("driver") so freshly-
  joined nodes appear as "waiting"; 10s auto-refresh)
- Hosts.razor (Akka cluster topology: members, status, roles, role-
  leader; 5s auto-refresh)

Host's stub App.razor deleted; Program.cs now points at
AdminUI.Components.App via an added using.

All 104 v2 tests remain green.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Routes.razor

@@ -0,0 +1,39 @@
+@* Router with AuthorizeRouteView so page-level [Authorize] attributes are enforced
+   (with plain RouteView, the attribute is inert — Admin-001). Unauthenticated users
+   hit the NotAuthorized slot and are bounced to /login; the route they came from is
+   round-tripped as ?returnUrl=. *@
+
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Layout
+
+<Router AppAssembly="@typeof(Routes).Assembly" AdditionalAssemblies="@AdditionalAssemblies">
+    <Found Context="routeData">
+        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
+            <NotAuthorized>
+                @if (context.User.Identity?.IsAuthenticated != true)
+                {
+                    <RedirectToLogin/>
+                }
+                else
+                {
+                    <LayoutView Layout="@typeof(MainLayout)">
+                        <p class="text-danger">You do not have permission to view this page.</p>
+                    </LayoutView>
+                }
+            </NotAuthorized>
+            <Authorizing>
+                <LayoutView Layout="@typeof(MainLayout)"><p>Authorizing…</p></LayoutView>
+            </Authorizing>
+        </AuthorizeRouteView>
+    </Found>
+</Router>
+
+@code {
+    /// <summary>
+    /// Hosts that want to expose pages defined in their own assembly pass them here. The fused
+    /// Host doesn't currently host its own routable pages — everything lives in this RCL — but
+    /// the parameter is here so a downstream consumer (or test rig) can extend without forking
+    /// Routes.razor.
+    /// </summary>
+    [Parameter]
+    public IEnumerable<System.Reflection.Assembly>? AdditionalAssemblies { get; set; }
+}