fix(admin): enforce authentication on all Admin UI routes (Admin-001/002)

Admin-001: Routes.razor used a plain RouteView, so the page-level
[Authorize] attributes on 11 pages were inert — every page, including
mutating ones, was reachable fully unauthenticated.
Admin-002: several pages (e.g. NewCluster, which writes config rows)
carried no auth attribute at all.

- Routes.razor: RouteView → AuthorizeRouteView with NotAuthorized /
  Authorizing slots; add RedirectToLogin component.
- Program.cs: SetFallbackPolicy(RequireAuthenticatedUser) — secure by
  default for new pages/endpoints.
- Login.razor: [AllowAnonymous] so login stays reachable; login page,
  /auth/* endpoints and static assets remain anonymous.
- Add [Authorize] to the previously un-gated pages; NewCluster gated to
  the CanPublish (FleetAdmin) policy.

Regression tests in PageAuthorizationTests pin that anonymous requests
to protected/mutating routes are rejected and that login + static
assets stay anonymously reachable. Admin test suite: 210/210 pass.

Resolves code-review findings Admin-001 and Admin-002 (Critical).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/AlarmsHistorian.razor

@@ -1,4 +1,5 @@
 @page "/alarms/historian"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using Microsoft.AspNetCore.Components.Web
 @using ZB.MOM.WW.OtOpcUa.Admin.Services
 @using ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Clusters/ClustersList.razor

@@ -1,4 +1,5 @@
 @page "/clusters"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using ZB.MOM.WW.OtOpcUa.Admin.Services
 @using ZB.MOM.WW.OtOpcUa.Configuration.Entities
 @inject ClusterService ClusterSvc

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Clusters/NewCluster.razor

@@ -1,4 +1,8 @@
 @page "/clusters/new"
+@* Cluster creation is a FleetAdmin operation per admin-ui.md "Add a new cluster" —
+   CanPublish gates it (Admin-002). Without this attribute the page was reachable
+   and its CreateAsync write path exploitable by any caller. *@
+@attribute [Microsoft.AspNetCore.Authorization.Authorize(Policy = "CanPublish")]
 @using System.ComponentModel.DataAnnotations
 @using Microsoft.AspNetCore.Components.Web
 @using ZB.MOM.WW.OtOpcUa.Admin.Services

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Drivers/FocasDetail.razor

@@ -1,4 +1,5 @@
 @page "/drivers/focas/{InstanceId}"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using ZB.MOM.WW.OtOpcUa.Admin.Services
 @inject FocasDriverDetailService DetailSvc
 

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Fleet.razor

@@ -1,4 +1,5 @@
 @page "/fleet"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using Microsoft.AspNetCore.Components.Web
 @using Microsoft.EntityFrameworkCore
 @using ZB.MOM.WW.OtOpcUa.Configuration

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Home.razor

@@ -1,4 +1,5 @@
 @page "/"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using Microsoft.AspNetCore.Components.Web
 @using ZB.MOM.WW.OtOpcUa.Admin.Services
 @using ZB.MOM.WW.OtOpcUa.Configuration.Entities

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Hosts.razor

@@ -1,4 +1,5 @@
 @page "/hosts"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using Microsoft.AspNetCore.Components.Web
 @using Microsoft.AspNetCore.SignalR.Client
 @using Microsoft.EntityFrameworkCore

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Login.razor

@@ -1,4 +1,7 @@
 @page "/login"
+@* The login page must stay anonymously reachable — otherwise the fallback
+   authorization policy (Admin-001) would lock operators out of the only way in. *@
+@attribute [Microsoft.AspNetCore.Authorization.AllowAnonymous]
 @using System.Security.Claims
 @using Microsoft.AspNetCore.Authentication
 @using Microsoft.AspNetCore.Authentication.Cookies

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Modbus/ModbusAddressPreview.razor

@@ -1,4 +1,5 @@
 @page "/modbus/address-preview"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using Microsoft.AspNetCore.Components.Web
 @using ZB.MOM.WW.OtOpcUa.Driver.Modbus
 @rendermode RenderMode.InteractiveServer

src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Modbus/ModbusDiagnostics.razor

@@ -1,4 +1,5 @@
 @page "/modbus/diagnostics/{DriverInstanceId}"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @using Microsoft.AspNetCore.Components.Web
 @using ZB.MOM.WW.OtOpcUa.Admin.Services
 @rendermode RenderMode.InteractiveServer