fix(code-review): resolve Batch 1 open findings (AdminUI auth, AlarmHistorian dispose guards, docs)

- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match
- AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs
- Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test)
- Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path
- Host-003: correct config-overlay precedence in ServiceHosting.md
- Configuration-014: LdapGroupRoleMapping collation-dependency doc
- Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)

code-reviews/Core.Scripting.Abstractions/findings.md

@@ -11,7 +11,7 @@
 | Review date | 2026-06-19 |
 | Commit reviewed | `7286d320` |
 | Status | Reviewed |
-| Open findings | 2 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -112,7 +112,7 @@ current naming convention. Verified by build (no test project for this module).
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ScriptContext.cs:84` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ScriptContext.Deadband` has no guard or documentation for invalid `tolerance`
 values. A negative `tolerance` makes `Math.Abs(current - previous) > tolerance` trivially `true`
@@ -132,9 +132,9 @@ changes the public API contract for authored scripts and needs a plan-level deci
 ///     Negative values cause the function to always return true; NaN always returns false.</param>
 ```
 
-**Resolution:** _(Open — the doc-only fix is zero-risk but the tolerance param is part of the
-locked script API surface; the decision on whether to also add a guard belongs at the plan level.
-Deferred until that call is made. No test project exists for this module.)_
+**Resolution:** Applied doc-only fix — updated the `<param name="tolerance">` XML doc in
+`ScriptContext.cs:90` to document that negative values always return true and NaN always returns
+false. No guard added (API contract change deferred per owner decision). 2026-06-20.
 
 ---
 
@@ -189,7 +189,7 @@ remarks in `ScriptContext.cs`. Verified by build (no test project for this modul
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `docs/ScriptedAlarms.md:298` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `docs/ScriptedAlarms.md` line 298 lists the file path as
 `src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/AlarmPredicateContext.cs`. The file was moved to
@@ -204,5 +204,7 @@ only thing that changed.
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/AlarmPredicateContext.cs` — script-side `ScriptContext` (read-only, write rejected)
 ```
 
-**Resolution:** _(Open — out of scope for this module's src-only fix pass. Should be fixed in a
-docs-cleanup commit targeting `docs/ScriptedAlarms.md`.)_
+**Resolution:** Updated `docs/ScriptedAlarms.md` line 298 — replaced the stale
+`Core.ScriptedAlarms/AlarmPredicateContext.cs` path with the correct
+`Core.Scripting.Abstractions/AlarmPredicateContext.cs` path. Verified the file exists at the new
+location before editing. 2026-06-20.