fix(gateway): resolve array attribute constraints by bare name via [] fallback

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/ConstraintEnforcer.cs

@@ -196,11 +196,30 @@ public sealed class ConstraintEnforcer(
 
     private GalaxyTagLookup? ResolveTarget(string tagAddress)
     {
-        GalaxyHierarchyCacheEntry entry = cache.Current;
-        return !string.IsNullOrWhiteSpace(tagAddress)
-            && entry.Index.TagsByAddress.TryGetValue(tagAddress, out GalaxyTagLookup? lookup)
-                ? lookup
-                : null;
+        if (string.IsNullOrWhiteSpace(tagAddress))
+        {
+            return null;
+        }
+
+        IReadOnlyDictionary<string, GalaxyTagLookup> tagsByAddress = cache.Current.Index.TagsByAddress;
+        if (tagsByAddress.TryGetValue(tagAddress, out GalaxyTagLookup? lookup))
+        {
+            return lookup;
+        }
+
+        // Galaxy SQL keys array attributes by their suffixed FullTagReference (e.g. "Obj.Arr[]"),
+        // but callers pass the bare address ("Obj.Arr") before the worker-boundary normalization
+        // runs. Probe the suffixed form so a bare array name resolves to its array attribute,
+        // consistent with ArrayAddressNormalizer. Only build the suffixed string on a direct miss
+        // when the address is not already suffixed, and only accept it when it is truly an array.
+        if (!tagAddress.EndsWith("[]", StringComparison.Ordinal)
+            && tagsByAddress.TryGetValue(tagAddress + "[]", out GalaxyTagLookup? arrayLookup)
+            && arrayLookup.Attribute?.IsArray == true)
+        {
+            return arrayLookup;
+        }
+
+        return null;
     }
 
     private static bool MatchesPathOrTag(