fix(code-review): resolve Batch 1 open findings (AdminUI auth, AlarmHistorian dispose guards, docs)

- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match
- AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs
- Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test)
- Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path
- Host-003: correct config-overlay precedence in ServiceHosting.md
- Configuration-014: LdapGroupRoleMapping collation-dependency doc
- Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)

tests/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.Tests/SqliteStoreAndForwardSinkTests.cs

@@ -850,6 +850,25 @@ public sealed class SqliteStoreAndForwardSinkTests : IDisposable
         sink.GetStatus().QueueDepth.ShouldBe(live, "GetStatus must agree with a fresh COUNT(*)");
     }
 
+    /// <summary>
+    ///     Regression for Core.AlarmHistorian-014: <see cref="SqliteStoreAndForwardSink.GetStatus"/>
+    ///     and <see cref="SqliteStoreAndForwardSink.RetryDeadLettered"/> must throw
+    ///     <see cref="ObjectDisposedException"/> after <see cref="SqliteStoreAndForwardSink.Dispose"/>
+    ///     is called, consistent with the guards already present on
+    ///     <see cref="SqliteStoreAndForwardSink.EnqueueAsync"/> and
+    ///     <see cref="SqliteStoreAndForwardSink.StartDrainLoop"/>.
+    /// </summary>
+    [Fact]
+    public void Disposed_sink_throws_ObjectDisposedException_on_GetStatus_and_RetryDeadLettered()
+    {
+        var writer = new FakeWriter();
+        var sink = new SqliteStoreAndForwardSink(_dbPath, writer, _log);
+        sink.Dispose();
+
+        Should.Throw<ObjectDisposedException>(() => sink.GetStatus());
+        Should.Throw<ObjectDisposedException>(() => sink.RetryDeadLettered());
+    }
+
     /// <summary>Insert a queue row whose PayloadJson cannot deserialize into an AlarmHistorianEvent.</summary>
     private void InsertCorruptRow(string alarmId)
     {