feat(auth)!: OtOpcUa canonical control-plane roles + config-DB migration (Task 1.7)

Standardize the control-plane admin role VALUES on the canonical six
(ZB.MOM.WW.Auth CanonicalRole). OtOpcUa uses four:
  ConfigViewer   -> Viewer
  ConfigEditor   -> Designer
  FleetAdmin     -> Administrator
  DriverOperator -> Operator   (appsettings-only string role)

This is a rename, not a permission change: enforcement semantics are
preserved (whoever could deploy/administer/operate before still can).

- AdminRole enum members renamed (persisted as string names via
  HasConversion<string>); RoleGrants.razor dropdown default updated.
- EF DATA migration CanonicalizeAdminRoles rewrites existing
  LdapGroupRoleMapping.Role rows old->new (Up) and back (Down); schema /
  model snapshot byte-identical (no pending model changes).
- Enforcement role STRINGS canonicalized:
  * Security policies keep their NAMES ("DriverOperator"/"FleetAdmin")
    but require canonical roles: RequireRole("Operator","Administrator")
    and RequireRole("Administrator").
  * Deployments.razor [Authorize(Roles="Administrator,Designer")].
  * DevStub now grants "Administrator"; LdapOptions/doc-comment examples
    canonicalized.
- Data-plane authorization (NodePermissions/NodeAcl/IPermissionEvaluator/
  TriePermissionEvaluator/UserAuthorizationState) UNTOUCHED.
- New CanonicalAdminRolesTests pins canonical claim values end-to-end and
  the real registered policies; existing role-string tests updated.

src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs

@@ -13,7 +13,7 @@ namespace ZB.MOM.WW.OtOpcUa.Security.Ldap;
 ///     library deliberately does not model:
 ///     <list type="number">
 ///         <item>the <see cref="LdapOptions.Enabled"/> master switch (disabled ⇒ deny, no bind); and</item>
-///         <item><see cref="LdapOptions.DevStubMode"/> — the dev bypass that grants a FleetAdmin
+///         <item><see cref="LdapOptions.DevStubMode"/> — the dev bypass that grants an Administrator
 ///             session WITHOUT touching the network, so an operator can navigate the full Admin UI
 ///             against a machine with no directory.</item>
 ///     </list>
@@ -24,12 +24,13 @@ namespace ZB.MOM.WW.OtOpcUa.Security.Ldap;
 ///     both the login endpoint and the OPC UA data-plane authenticator call with the returned
 ///     <see cref="LdapAuthResult.Groups"/>. The only path that pre-populates
 ///     <see cref="LdapAuthResult.Roles"/> is the DevStub success; consumers union that pre-resolved
-///     set with the mapper output so the dev FleetAdmin grant survives the move to the mapper.
+///     set with the mapper output so the dev Administrator grant survives the move to the mapper.
 /// </summary>
 /// <remarks>
 ///     Fail-closed: the library never throws, and this wrapper adds no new throwing paths. The
-///     DevStub result mirrors the legacy bespoke service exactly (group <c>"dev"</c>, role
-///     <c>"FleetAdmin"</c>) so behaviour is preserved bit-for-bit on dev nodes.
+///     DevStub result grants the canonical <c>"Administrator"</c> control-plane role (group
+///     <c>"dev"</c>) so the dev session can navigate the full Admin UI (Task 1.7 renamed the prior
+///     <c>"FleetAdmin"</c> to the canonical <c>"Administrator"</c>).
 /// </remarks>
 public sealed class OtOpcUaLdapAuthService : ILdapAuthService
 {
@@ -77,12 +78,13 @@ public sealed class OtOpcUaLdapAuthService : ILdapAuthService
 
         if (_options.DevStubMode)
         {
-            // Dev bypass: accept any non-empty credentials and grant FleetAdmin WITHOUT a real bind.
+            // Dev bypass: accept any non-empty credentials and grant Administrator WITHOUT a real bind.
             // Pre-populated Roles are unioned with the mapper output by both consumers, so the grant
-            // survives the move to IGroupRoleMapper. Mirrors the legacy bespoke service exactly.
+            // survives the move to IGroupRoleMapper. (Task 1.7 canonicalized the role string from the
+            // prior "FleetAdmin" to "Administrator".)
             _logger.LogWarning(
                 "OtOpcUaLdapAuthService: DevStubMode bypass — accepting {User} without a real LDAP bind", username);
-            return new(true, username, username, ["dev"], ["FleetAdmin"], null);
+            return new(true, username, username, ["dev"], ["Administrator"], null);
         }
 
         // Fail closed on a plaintext transport unless explicitly opted in. The bespoke service