feat(configdb): add Deployment, NodeDeploymentState, ConfigEdit, DataProtectionKey entities

Phase 1 entities for the v2 live-edit + snapshot-deploy model:

  Deployment           — immutable artifact snapshot (replaces v1 ConfigGeneration row)
                         Status enum {Dispatching, AwaitingApplyAcks, Sealed,
                         PartiallyFailed, TimedOut}; carries the SHA256 RevisionHash and
                         the SnapshotAndFlatten() ArtifactBlob; RowVersion for optimistic
                         concurrency.
  NodeDeploymentState  — per-(node, deployment) apply progress row owned by
                         DriverHostActor (replaces single-row ClusterNodeGenerationState).
                         Composite key (NodeId, DeploymentId) gives the
                         ConfigPublishCoordinator the full history it needs to
                         reconstruct in-flight state after a failover.
  ConfigEdit           — append-only audit row written by AdminOperationsActor on every
                         mutating op; optional ExecutionId correlates edits inside one
                         admin transaction (e.g. an import batch).
  DataProtectionKey    — ASP.NET DataProtection key ring storage via
                         IDataProtectionKeyContext so every admin-role node decrypts
                         the same cookies without sharing a filesystem.

OtOpcUaConfigDbContext now implements IDataProtectionKeyContext and registers four new
DbSets + four new ConfigureXxx mappings.

Central package bumps (forced by Microsoft.AspNetCore.DataProtection.EntityFrameworkCore
10.0.7's transitive dep):

  Microsoft.EntityFrameworkCore.{,Design,InMemory,SqlServer}  10.0.0 -> 10.0.7
  Microsoft.Extensions.{Configuration.Abstractions,Configuration.Json,Hosting,Hosting.WindowsServices,Http}  10.0.0 -> 10.0.7

EF migration generation + the ConfigGeneration drop + RedundancyRole column removal are
deferred to Task 14 (high-risk, non-parallelizable).

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Entities/ConfigEdit.cs

@@ -0,0 +1,27 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+
+/// <summary>
+///     Append-only audit row written by AdminOperationsActor on every mutating live-edit
+///     operation. The ExecutionId optionally correlates a sequence of edits that ran inside one
+///     admin transaction (e.g. an import batch that updates many Equipment rows).
+/// </summary>
+public sealed class ConfigEdit
+{
+    public Guid EditId { get; init; } = Guid.NewGuid();
+
+    public required string EntityType { get; init; }
+
+    public Guid EntityId { get; init; }
+
+    /// <summary>JSON payload of the column-name → new-value pairs touched by this edit.</summary>
+    public required string FieldsJson { get; init; }
+
+    /// <summary>Optional correlation across edits inside a single admin operation.</summary>
+    public Guid? ExecutionId { get; init; }
+
+    public required string EditedBy { get; init; }
+
+    public DateTime EditedAtUtc { get; init; } = DateTime.UtcNow;
+
+    public required string SourceNode { get; init; }
+}