feat(admin): headless POST /api/deployments REST endpoint (API-key gated)

A thin gateway over the admin-operations cluster singleton so CI/scripts can trigger a
deployment without the Blazor button. Forwards to the same IAdminOperationsClient.
StartDeploymentAsync; mounted on admin-role nodes. Auth is a fixed-time X-Api-Key check
against Security:DeployApiKey (orthogonal to the cookie-only web auth); AllowAnonymous so the
auth fallback doesn't 401 it, self-disabling (503) until the key is set. Outcome->status:
202/200/409/422. Unit tests for the key check + outcome mapping; HTTP E2E (real auth + real
deploy via the 2-node harness). Documented in docs/security.md.

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -26,6 +26,7 @@ using ZB.MOM.WW.OtOpcUa.Security.Endpoints;
 using ZB.MOM.WW.OtOpcUa.Security.Ldap;
 using ZB.MOM.WW.Configuration;
 using ZB.MOM.WW.Telemetry.Serilog;
+using ZB.MOM.WW.OtOpcUa.AdminUI.Api;
 
 // Roles drive the entire conditional wiring below — see ZB.MOM.WW.OtOpcUa.Cluster.RoleParser.
 var roles = RoleParser.Parse(Environment.GetEnvironmentVariable("OTOPCUA_ROLES"));
@@ -183,6 +184,8 @@ if (hasAdmin)
     app.MapOtOpcUaAuth();
     app.MapAdminUI<App>();
     app.MapOtOpcUaHubs();
+    // Headless deploy trigger for CI/scripts (API-key gated; disabled until Security:DeployApiKey set).
+    app.MapOtOpcUaDeployApi(app.Configuration);
 }
 
 app.MapOtOpcUaHealth();