fix(code-review): resolve Batch 1 open findings (AdminUI auth, AlarmHistorian dispose guards, docs)

- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match
- AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs
- Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test)
- Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path
- Host-003: correct config-overlay precedence in ServiceHosting.md
- Configuration-014: LdapGroupRoleMapping collation-dependency doc
- Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/AlertHub.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.SignalR;
 
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
@@ -8,6 +9,7 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 /// clears, or is acknowledged on any cluster node. Bridge: <c>AlertSignalRBridge</c> subscribes
 /// to the <c>alerts</c> DPS topic and forwards to every connected SignalR client.
 /// </summary>
+[Authorize]
 public sealed class AlertHub : Hub
 {
     public const string Endpoint = "/hubs/alerts";

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/FleetStatusHub.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.SignalR;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Fleet;
 
@@ -10,6 +11,7 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 /// Server pushes fleet-status updates to connected clients via <c>FleetStatusSignalRBridge</c>
 /// (DistributedPubSub 'fleet-status' → <c>IHubContext&lt;FleetStatusHub&gt;</c>).
 /// </summary>
+[Authorize]
 public sealed class FleetStatusHub : Hub
 {
     public const string Endpoint = "/hubs/fleet-status";

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/ScriptLogHub.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.SignalR;
 
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
@@ -9,6 +10,7 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 /// <c>ScriptLogSignalRBridge</c> subscribes to the <c>script-logs</c> DPS topic and forwards
 /// to every connected SignalR client.
 /// </summary>
+[Authorize]
 public sealed class ScriptLogHub : Hub
 {
     public const string Endpoint = "/hubs/script-log";