review(b2-waveA): /raw auto-expand enterprise roots; friendly create-race + delete failures; auth-guard classifies /raw + dev demo

Wave-A reviewer findings (no Critical/High):
- M-2: GlobalRaw auto-expands Enterprise roots so the Cluster level is visible on load (mirrors GlobalUns.ExpandStructural); clusters stay lazily collapsed.
- L-1: create mutations route SaveChanges through SaveCreateAsync — a lost sibling-name race (filtered-unique-index clash) becomes a friendly failure instead of an uncaught DbUpdateException.
- L-2: SaveDeleteAsync no longer leaks raw EF/SQL text; operator-friendly guidance.
- L-5: RawNode.ChildCount doc clarified (direct children only).
- Regression fix: PageAuthorizationGuardTests classifies the two new routable pages (/raw → ConfigEditor, /dev/context-menu-demo → AuthenticatedRead).
M-1 (ordinal vs SQL-collation sibling uniqueness) assessed benign: name indexes use the DB default collation and the server-side pre-check runs under that same collation, so pre-check and index agree — no case-variant rows can coexist, so runtime ordinal RawPath keying never collides.

Claude-Session: https://claude.ai/code/session_01LVneM3eh1UtJxEisFXgmox

tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/Authorization/PageAuthorizationGuardTests.cs

@@ -29,8 +29,9 @@ public class PageAuthorizationGuardTests
     /// </summary>
     private static readonly IReadOnlyDictionary<Type, string> ExpectedPolicy = new Dictionary<Type, string>
     {
-        // ── ConfigEditor (20): the config-authoring surface (incl. live ResilienceConfig) ──
+        // ── ConfigEditor (21): the config-authoring surface (incl. live ResilienceConfig) ──
         [typeof(GlobalUns)] = AdminUiPolicies.ConfigEditor,
+        [typeof(global::ZB.MOM.WW.OtOpcUa.AdminUI.Components.Pages.Raw.GlobalRaw)] = AdminUiPolicies.ConfigEditor,
         [typeof(EquipmentPage)] = AdminUiPolicies.ConfigEditor,
         [typeof(NewCluster)] = AdminUiPolicies.ConfigEditor,
         [typeof(ClusterEdit)] = AdminUiPolicies.ConfigEditor,
@@ -54,8 +55,9 @@ public class PageAuthorizationGuardTests
         // ── FleetAdmin (1) ──
         [typeof(RoleGrants)] = AdminUiPolicies.FleetAdmin,
 
-        // ── AuthenticatedRead (16): dashboards, lists, live tails (read-only) ──
+        // ── AuthenticatedRead (17): dashboards, lists, live tails (read-only) + the dev ContextMenu demo ──
         [typeof(Home)] = AdminUiPolicies.AuthenticatedRead,
+        [typeof(global::ZB.MOM.WW.OtOpcUa.AdminUI.Components.Pages.Dev.ContextMenuDemo)] = AdminUiPolicies.AuthenticatedRead,
         [typeof(Fleet)] = AdminUiPolicies.AuthenticatedRead,
         [typeof(global::ZB.MOM.WW.OtOpcUa.AdminUI.Components.Pages.Hosts)] = AdminUiPolicies.AuthenticatedRead,
         [typeof(Alerts)] = AdminUiPolicies.AuthenticatedRead,