feat(auth)!: OtOpcUa canonical control-plane roles + config-DB migration (Task 1.7)

Standardize the control-plane admin role VALUES on the canonical six
(ZB.MOM.WW.Auth CanonicalRole). OtOpcUa uses four:
  ConfigViewer   -> Viewer
  ConfigEditor   -> Designer
  FleetAdmin     -> Administrator
  DriverOperator -> Operator   (appsettings-only string role)

This is a rename, not a permission change: enforcement semantics are
preserved (whoever could deploy/administer/operate before still can).

- AdminRole enum members renamed (persisted as string names via
  HasConversion<string>); RoleGrants.razor dropdown default updated.
- EF DATA migration CanonicalizeAdminRoles rewrites existing
  LdapGroupRoleMapping.Role rows old->new (Up) and back (Down); schema /
  model snapshot byte-identical (no pending model changes).
- Enforcement role STRINGS canonicalized:
  * Security policies keep their NAMES ("DriverOperator"/"FleetAdmin")
    but require canonical roles: RequireRole("Operator","Administrator")
    and RequireRole("Administrator").
  * Deployments.razor [Authorize(Roles="Administrator,Designer")].
  * DevStub now grants "Administrator"; LdapOptions/doc-comment examples
    canonicalized.
- Data-plane authorization (NodePermissions/NodeAcl/IPermissionEvaluator/
  TriePermissionEvaluator/UserAuthorizationState) UNTOUCHED.
- New CanonicalAdminRolesTests pins canonical claim values end-to-end and
  the real registered policies; existing role-string tests updated.

src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs

@@ -103,14 +103,17 @@ public static class ServiceCollectionExtensions
                 .RequireAuthenticatedUser()
                 .Build();
 
-            // DriverOperator: may issue Reconnect/Restart commands against live driver instances
-            // from the Admin UI DriverStatusPanel. Map LDAP group → role via GroupToRole in
-            // appsettings (e.g. "ot-driver-operator": "DriverOperator").
+            // DriverOperator (policy NAME kept stable): may issue Reconnect/Restart commands against
+            // live driver instances from the Admin UI DriverStatusPanel. The role STRINGS it requires
+            // are the canonical control-plane roles (Task 1.7): Operator (was DriverOperator) and
+            // Administrator (was FleetAdmin). Map LDAP group → role via GroupToRole in appsettings
+            // (e.g. "ot-driver-operator": "Operator").
             o.AddPolicy("DriverOperator", policy =>
-                policy.RequireRole("DriverOperator", "FleetAdmin"));
+                policy.RequireRole("Operator", "Administrator"));
 
-            // FleetAdmin: full administrative access; gates fleet-wide pages such as RoleGrants.
-            o.AddPolicy("FleetAdmin", policy => policy.RequireRole("FleetAdmin"));
+            // FleetAdmin (policy NAME kept stable): full administrative access; gates fleet-wide pages
+            // such as RoleGrants. Requires the canonical Administrator role (was FleetAdmin).
+            o.AddPolicy("FleetAdmin", policy => policy.RequireRole("Administrator"));
         });
 
         return services;