fix(code-review): resolve Batch 1 open findings (AdminUI auth, AlarmHistorian dispose guards, docs)

- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match
- AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs
- Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test)
- Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path
- Host-003: correct config-overlay precedence in ServiceHosting.md
- Configuration-014: LdapGroupRoleMapping collation-dependency doc
- Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/TwinCATDataType.cs

@@ -29,6 +29,12 @@ public enum TwinCATDataType
     Date,   // DATE — seconds since 1970-01-01 truncated to a day boundary, stored as UDINT
     DateTime, // DT (DATE_AND_TIME) — seconds since 1970-01-01, stored as UDINT
     TimeOfDay,// TOD — milliseconds since midnight, stored as UDINT
-    /// <summary>UDT / FB instance. Resolved per member at discovery time.</summary>
+    /// <summary>
+    /// UDT / FB instance. Used internally by <c>DiscoverAsync</c> when browsing controller
+    /// symbols — members are resolved to atomic types and emitted individually. Must not be
+    /// used in pre-declared tags (rejected at initialisation by the factory with
+    /// <see cref="InvalidOperationException"/>) or in AdminUI equipment-tag configs (the typed
+    /// editor does not offer it; the parser falls back to <c>DInt</c>).
+    /// </summary>
     Structure,
 }