Remove static Users auth, use shared QualityMapper for historian, simplify LDAP permission checks

- Remove ConfigUserAuthenticationProvider and Users property — LDAP is the only auth mechanism
- Fix historian quality mapping to use existing QualityMapper (OPC DA quality bytes, not custom mapping)
- Add AppRoles constants, unify HasWritePermission/HasAlarmAckPermission into shared HasRole helper
- Hoist write permission check out of per-item loop, eliminate redundant _ldapRolesEnabled field
- Update docs (Configuration.md, Security.md, OpcUaServer.md, HistoricalDataAccess.md)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.LmxOpcUa.Host/Configuration/ConfigurationValidator.cs

@@ -119,15 +119,6 @@ namespace ZB.MOM.WW.LmxOpcUa.Host.Configuration
                 {
                     Log.Warning("Authentication.Ldap.ServiceAccountDn is empty — group lookups will fail");
                 }
-
-                if (config.Authentication.Users.Count > 0)
-                {
-                    Log.Warning("Authentication.Users list is ignored when Ldap is enabled");
-                }
-            }
-            else if (config.Authentication.Users.Count > 0)
-            {
-                Log.Information("Authentication.Users configured: {Count} user(s)", config.Authentication.Users.Count);
             }
 
             // Redundancy