feat(auth)!: OtOpcUa canonical control-plane roles + config-DB migration (Task 1.7)

Standardize the control-plane admin role VALUES on the canonical six
(ZB.MOM.WW.Auth CanonicalRole). OtOpcUa uses four:
  ConfigViewer   -> Viewer
  ConfigEditor   -> Designer
  FleetAdmin     -> Administrator
  DriverOperator -> Operator   (appsettings-only string role)

This is a rename, not a permission change: enforcement semantics are
preserved (whoever could deploy/administer/operate before still can).

- AdminRole enum members renamed (persisted as string names via
  HasConversion<string>); RoleGrants.razor dropdown default updated.
- EF DATA migration CanonicalizeAdminRoles rewrites existing
  LdapGroupRoleMapping.Role rows old->new (Up) and back (Down); schema /
  model snapshot byte-identical (no pending model changes).
- Enforcement role STRINGS canonicalized:
  * Security policies keep their NAMES ("DriverOperator"/"FleetAdmin")
    but require canonical roles: RequireRole("Operator","Administrator")
    and RequireRole("Administrator").
  * Deployments.razor [Authorize(Roles="Administrator,Designer")].
  * DevStub now grants "Administrator"; LdapOptions/doc-comment examples
    canonicalized.
- Data-plane authorization (NodePermissions/NodeAcl/IPermissionEvaluator/
  TriePermissionEvaluator/UserAuthorizationState) UNTOUCHED.
- New CanonicalAdminRolesTests pins canonical claim values end-to-end and
  the real registered policies; existing role-string tests updated.

tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/OtOpcUaLdapAuthServiceTests.cs

@@ -21,9 +21,9 @@ public sealed class OtOpcUaLdapAuthServiceTests
     private static OtOpcUaLdapAuthService Build(LdapOptions options, RecordingLibService inner) =>
         new(options, inner, NullLogger<OtOpcUaLdapAuthService>.Instance);
 
-    /// <summary>DevStubMode on → stub FleetAdmin success WITHOUT hitting the library.</summary>
+    /// <summary>DevStubMode on → stub Administrator success WITHOUT hitting the library.</summary>
     [Fact]
-    public async Task DevStubMode_grants_FleetAdmin_without_calling_the_library()
+    public async Task DevStubMode_grants_Administrator_without_calling_the_library()
     {
         var inner = new RecordingLibService(LibLdapAuthResult.Fail(LdapAuthFailure.BadCredentials));
         var sut = Build(new LdapOptions { Enabled = true, DevStubMode = true }, inner);
@@ -33,7 +33,7 @@ public sealed class OtOpcUaLdapAuthServiceTests
         result.Success.ShouldBeTrue();
         result.Username.ShouldBe("anyone");
         result.Groups.ShouldBe(new[] { "dev" });
-        result.Roles.ShouldBe(new[] { "FleetAdmin" });
+        result.Roles.ShouldBe(new[] { "Administrator" });
         inner.Called.ShouldBeFalse("DevStubMode must never reach the real directory client");
     }