fix(mqtt): browse-commit writes a bindable address + a Request-rebirth affordance

Two gaps the Task 23/24 review found, both blocking Task 26's live gate.

Gap 1 — browse-commit produced a silently dead MQTT tag. RawBrowseCommitMapper
had no `Mqtt` case, so a committed leaf fell through to the generic
`{"address": …}` key. Neither MqttTagDefinitionFactory entry point reads
`address`: the tag deployed clean and reported BadNodeIdUnknown forever, with
no signal at commit time. Predates Task 23 (Plain was affected too), but Task 23
built the Sparkplug metric tree precisely so an operator could browse and commit
a binding.

The address is a DESCRIPTOR, not a reference string, and it cannot be recovered
from the browse node id: `{group}/{node}[/{device}]::{metric}` where a metric
name legitimately contains `/` (`Node Control/Rebirth`) — the ambiguity
MetricSeparator's remarks already name. So the session STATES it, via a new
`AttributeInfo.AddressFields` seam, and the mapper reads it. Which keys are
emitted is also how the mapper learns Plain vs Sparkplug — the driver type
reaching it is just `Mqtt`, and the mode lives on the driver config. Key names
are single-sourced in the new `MqttTagConfigKeys` (producer, mapper, factory),
with the literals pinned by a test so a symmetric rename cannot silently unbind
already-persisted blobs. A leaf with no stated address is refused at commit in
words rather than committed dead.

Gap 2 — RequestRebirthAsync had no UI. Task 23 shipped it backend-only; Task 26
step 1 assumes the button, and Task 25's runbook notes the picker tree stays
empty until a birth lands, so it is the only way to fill it on demand. Added to
the /raw browse modal: scope = the clicked tree node (device/metric resolve up to
their edge node, group fans out and is refused whole past 32), an explicit
two-click confirm naming the resolved scope and its consequence, the outcome or
the refusal shown rather than swallowed. Offered only for a Sparkplug session
(new `IRebirthCapableBrowseSession.RebirthAvailable` — one session class serves
both modes, so a type test alone would draw a button that can only throw) and
only to a DriverOperator; the server-side gate remains the boundary.

Tests: MQTT 545 → 581, AdminUI 781 → 800. The round-trip tests feed the emitted
blob to the REAL factory and were falsified by mutating the emitted key name.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/Browsing/BrowserSessionServiceTests.cs

@@ -290,6 +290,27 @@ public sealed class BrowserSessionServiceTests
             () => service.RequestRebirthAsync(Guid.NewGuid(), "Plant1/EdgeA", CancellationToken.None));
     }
 
+    [Fact]
+    public void CanRequestRebirth_IsTrue_OnlyForASessionThatAdvertisesTheAction()
+    {
+        // The picker draws its Request-rebirth affordance off this. A session type CAN re-announce
+        // (MqttBrowseSession implements the interface) while a given INSTANCE cannot — a plain-MQTT
+        // window publishes nothing, ever — so a type test alone would draw a button that only throws.
+        var registry = new BrowseSessionRegistry();
+        var sparkplug = new FakeRebirthCapableBrowseSession();
+        var plain = new FakeRebirthCapableBrowseSession { RebirthAvailable = false };
+        var plainOldSession = new FakeBrowseSession();
+        registry.Register(sparkplug);
+        registry.Register(plain);
+        registry.Register(plainOldSession);
+        var service = NewServiceWithAuthz(registry, authorized: true);
+
+        service.CanRequestRebirth(sparkplug.Token).ShouldBeTrue();
+        service.CanRequestRebirth(plain.Token).ShouldBeFalse();
+        service.CanRequestRebirth(plainOldSession.Token).ShouldBeFalse();
+        service.CanRequestRebirth(Guid.NewGuid()).ShouldBeFalse();   // unknown/reaped token
+    }
+
     /// <summary>A browse session that records the rebirth scopes it was asked for.</summary>
     private sealed class FakeRebirthCapableBrowseSession : IRebirthCapableBrowseSession
     {
@@ -299,6 +320,9 @@ public sealed class BrowserSessionServiceTests
 
         public int Published { get; init; } = 1;
 
+        /// <summary>Whether this fake session advertises the action (a plain-MQTT window does not).</summary>
+        public bool RebirthAvailable { get; init; } = true;
+
         public List<string> Scopes { get; } = [];
 
         public Task<int> RequestRebirthAsync(string scope, CancellationToken cancellationToken)