feat(health)!: active node is the oldest Up member, not the leader (0.3.0)

Promotes the two apps' private replacements for ActiveNodeHealthCheck into one
shared primitive, and retires the leader/RoleLeader selection they were written
to avoid.

Both Akka consumers had already hand-rolled a replacement rather than use this
package (ScadaBridge OldestNodeActiveHealthCheck, OtOpcUa
ClusterPrimaryHealthCheck), so the entire active-node surface here —
ActiveNodeHealthCheck, AkkaActiveNodeGate — had ZERO consumers. It was not
merely unused: it was avoided, twice, for the same reason.

Leadership is address-ordered (host, then port) and has no relationship to time;
singleton placement is age-ordered. The two agree on a freshly-formed cluster,
which is why single-node and happy-path tests never caught it. They diverge
permanently after any restart: the restarted node rejoins as the youngest but
keeps its address, so if it holds the lower address it becomes leader while the
singletons — and all the work they own — stay on the other node.

New ClusterActiveNode is the single implementation: oldest Up member, optional
role scope, plus role-preference resolution for a fused node that must answer
for the role its singletons are pinned to. ActiveNodeHealthCheck and
AkkaActiveNodeGate both delegate to it, so an endpoint gate and the
/health/active probe an orchestrator routes by cannot disagree.

BREAKING (behaviour, not signature):
- Selection is by age, not leadership.
- The role-filtered mode no longer reports Healthy for a node LACKING the role.
  That "not applicable => Healthy" made the tier answer 200 on every node and
  silently broke leader-pinning (lmxopcua#494); it is now Unhealthy by default,
  overridable via NoActiveRoleStatus. This case is reachable, not defensive —
  OtOpcUa's RoleParser admits dev-only and cluster-role-only nodes.
- Identity compares UniqueAddress, so a node restarted on the same host:port is
  correctly a different member during the overlap.

Results now carry activeRole/selfAddress/activeNode in the 0.2.0 per-entry data
object, so a standby reports WHO is active and a dashboard can render a pair
from either node's payload alone.

Tests: 45 Akka (was 39), 76 total. The age-vs-address divergence is pinned
against a real two-node cluster built so the oldest member is not the
lowest-addressed one, with a fixture sanity check so it cannot pass for the
wrong reason.

ZB.MOM.WW.Health/tests/ZB.MOM.WW.Health.Akka.Tests/ActiveRoleResolutionTests.cs

@@ -0,0 +1,56 @@
+using ZB.MOM.WW.Health.Akka;
+
+namespace ZB.MOM.WW.Health.Akka.Tests;
+
+/// <summary>
+/// Covers <see cref="ClusterActiveNode.ResolveActiveRole"/> — which role a node competes for. Pure,
+/// so no cluster is needed; the age-ordering half of the rule is pinned in
+/// <see cref="ClusterActiveNodeTests"/> against a real two-node cluster.
+/// </summary>
+public sealed class ActiveRoleResolutionTests
+{
+    [Fact]
+    public void EmptyPreference_IsUnscoped()
+    {
+        // Unscoped: every Up member competes for one active slot (the ScadaBridge central pattern).
+        Assert.Null(ClusterActiveNode.ResolveActiveRole(["admin", "driver"], []));
+    }
+
+    [Fact]
+    public void FusedNode_AnswersForTheHighestPrecedenceRoleItCarries()
+    {
+        Assert.Equal(
+            "admin",
+            ClusterActiveNode.ResolveActiveRole(["admin", "driver", "cluster-MAIN"], ["admin", "driver"]));
+    }
+
+    [Fact]
+    public void SingleRoleNode_AnswersForThatRole()
+    {
+        // The regression the OtOpcUa fix existed for: under the old role-filtered check every
+        // driver-only node reported Healthy — "or not a role member" — so all of them called
+        // themselves active and no consumer could find the active node of a site cluster. lmxopcua#494.
+        Assert.Equal(
+            "driver",
+            ClusterActiveNode.ResolveActiveRole(["driver", "cluster-SITE-A"], ["admin", "driver"]));
+    }
+
+    [Fact]
+    public void PreferenceOrderWins_NotTheOrderTheNodeListsItsRoles()
+    {
+        // Self-role order is incidental (it comes from config parsing); precedence must come from the
+        // caller's list alone, or a fused node's answer would depend on how its roles were spelled.
+        Assert.Equal(
+            "admin",
+            ClusterActiveNode.ResolveActiveRole(["driver", "admin"], ["admin", "driver"]));
+    }
+
+    [Fact]
+    public void NodeCarryingNoneOfThePreferredRoles_ResolvesToNull()
+    {
+        // Reachable, not merely defensive: OtOpcUa's RoleParser admits a dev-only or cluster-role-only
+        // node. Such a node owns no active work — the health check maps this to Unhealthy so it stays
+        // out of the active pool.
+        Assert.Null(ClusterActiveNode.ResolveActiveRole(["dev", "cluster-MAIN"], ["admin", "driver"]));
+    }
+}