fix(config): let env vars override per-role appsettings overlay + correct dev-compose Ldap section

The per-role overlay (appsettings.{role}.json) was appended after WebApplicationBuilder's
default sources, so it outranked environment variables — a baked role file could not be
overridden by a deployment env var. In otopcua-dev this meant appsettings.admin.json's
Security:Ldap:DevStubMode=false beat the compose's DevStub override, so every AdminUI login
attempted a real LDAP bind against a non-existent server and failed with 'Unexpected
authentication error'.

- Program.cs: re-append AddEnvironmentVariables() + AddCommandLine(args) after the role
  overlay so deployment overrides keep top precedence (overlay still beats base appsettings).
- docker-dev/docker-compose.yml: the DevStub env var targeted the stale 'Authentication:Ldap'
  section; the code reads 'Security:Ldap'. Corrected the prefix on every host node (+ comment).

Dev AdminUI login now signs in as Administrator via the DevStub bypass.

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -49,8 +49,18 @@ builder.Host.UseWindowsService(options => options.ServiceName = "OtOpcUaHost");
 // (both). Optional — base appsettings.json carries enough to boot if these don't exist.
 var roleSuffix = roles.Length == 0 ? null : string.Join('-', roles.OrderBy(r => r, StringComparer.Ordinal));
 if (roleSuffix is not null)
+{
     builder.Configuration.AddJsonFile($"appsettings.{roleSuffix}.json", optional: true, reloadOnChange: true);
 
+    // The overlay above is appended AFTER WebApplicationBuilder's default sources, so without this it
+    // would outrank environment variables and command-line args — i.e. a baked role file could not be
+    // overridden by a deployment env var (e.g. the dev compose's Security__Ldap__DevStubMode=true was
+    // silently beaten by appsettings.admin.json's DevStubMode:false). Re-append env vars then args last
+    // so deployment overrides keep top precedence; the overlay still wins over base appsettings.json.
+    builder.Configuration.AddEnvironmentVariables();
+    builder.Configuration.AddCommandLine(args);
+}
+
 // Serilog — shared ZB.MOM.WW.Telemetry bootstrap. Sinks (Console + rolling daily file)
 // now live in appsettings.json (ReadFrom.Configuration); AddZbSerilog layers in the
 // shared NodeHostname / TraceContext / Redaction enrichers and trace correlation.