fix(code-review): resolve Batch 1 open findings (AdminUI auth, AlarmHistorian dispose guards, docs)

- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match
- AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs
- Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test)
- Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path
- Host-003: correct config-overlay precedence in ServiceHosting.md
- Configuration-014: LdapGroupRoleMapping collation-dependency doc
- Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Services/ILdapGroupRoleMappingService.cs

@@ -20,7 +20,11 @@ public interface ILdapGroupRoleMappingService
     /// <summary>List every mapping whose LDAP group matches one of <paramref name="ldapGroups"/>.</summary>
     /// <remarks>
     ///     Hot path — fires on every sign-in. The default EF implementation relies on the
-    ///     <c>IX_LdapGroupRoleMapping_Group</c> index. Case-insensitive per LDAP conventions.
+    ///     <c>IX_LdapGroupRoleMapping_Group</c> index. The match is a SQL <c>IN (…)</c> whose
+    ///     case-sensitivity is determined by the <c>LdapGroup</c> column collation. Case-insensitive
+    ///     behaviour requires a case-insensitive (CI) server or column collation — this is a
+    ///     deployment requirement. On a case-sensitive-collation server the lookup will silently
+    ///     miss rows that differ only in case.
     /// </remarks>
     /// <param name="ldapGroups">The LDAP groups to search for.</param>
     /// <param name="cancellationToken">The cancellation token.</param>