fix(code-review): resolve Batch 1 open findings (AdminUI auth, AlarmHistorian dispose guards, docs)

- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match
- AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs
- Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test)
- Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path
- Host-003: correct config-overlay precedence in ServiceHosting.md
- Configuration-014: LdapGroupRoleMapping collation-dependency doc
- Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)

code-reviews/Driver.TwinCAT.Contracts/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-06-19 |
 | Commit reviewed | `a19b0f86` |
 | Status | Reviewed |
-| Open findings | 1 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -83,7 +83,7 @@ the actual `TryGetInt32` call; no behaviour change. Verified by build: 0 errors,
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `TwinCATDataType.cs:33` (`Structure` member) |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `Structure` enum member's XML summary says "UDT / FB instance. Resolved
 per member at discovery time." This is accurate for the discovery path, but the comment omits
@@ -108,4 +108,9 @@ not appear in operator-authored config.
 Structure,
 ```
 
-**Resolution:** _(empty until closed)_
+**Resolution:** Resolved 2026-06-20 — expanded the `Structure` XML doc on `TwinCATDataType.cs:33`
+to document the full contract: discovery-only sentinel, rejected at pre-declaration by
+`TwinCATDriverFactoryExtensions.BuildTag` (`InvalidOperationException`), and not offered by the
+AdminUI typed editor (parser falls back to `DInt`). Facts verified against
+`TwinCATDriverFactoryExtensions.cs` (line 96–99) and `TwinCATEquipmentTagParser.cs` (line 31).
+Build: 0 errors, 0 warnings.