fix(authz): give HistoryUpdate its own NodePermissions bit (was aliased to HistoryRead) [H2]

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodePermissions.cs

@@ -29,6 +29,11 @@ public enum NodePermissions : int
     // OPC UA Part 4 §5.11
     MethodCall = 1 << 11,
 
+    // OPC UA HistoryUpdate (annotation / insert / delete) — separate from HistoryRead so a
+    // read-only grant cannot authorize historian writes. Not included in any composite bundle
+    // until the HistoryUpdate service surface is implemented.
+    HistoryUpdate = 1 << 12,
+
     // Bundles (one-click grants in Admin UI)
     ReadOnly = Browse | Read | Subscribe | HistoryRead | AlarmRead,
     Operator = ReadOnly | WriteOperate | AlarmAcknowledge | AlarmConfirm,