[AZ-513] [AZ-196] [AZ-183] Add /classes CRUD, /devices, fleet OTA

AZ-513: POST/PATCH/DELETE /classes for detection-class CRUD; new
DetectionClass entity, schema, DTOs, IDetectionClassService. Unblocks
ui/AZ-512.

AZ-196: POST /devices auto-assigns sequential azj-NNNN serial+email
+password and inserts a CompanionPC user. Returns plaintext credentials
for the provisioning script.

AZ-183: Resources table + POST /get-update + POST /resources/publish
for fleet OTA. Per-resource encryption_key column AES-256-CBC encrypted
at rest with ResourcesConfig.EncryptionMasterKey; ICache wraps the
per-(arch,stage) latest-versions lookup and is invalidated on publish.

Adds IDbFactory.RunAdmin<T> overload for write-and-return.

Backfills _docs/02_document/module-layout.md to satisfy the implement
skill's File Ownership prerequisite (the _docs/ artifact set predates
the Step 1.5 module-layout addition).

Code review: PASS_WITH_WARNINGS — see
_docs/03_implementation/reviews/batch_05_review.md.

Co-authored-by: Cursor <cursoragent@cursor.com>

Azaion.Common/Configs/ResourcesConfig.cs

@@ -5,4 +5,11 @@ public class ResourcesConfig
     public string ResourcesFolder { get; set; } = null!;
     public string SuiteInstallerFolder { get; set; } = null!;
     public string SuiteStageInstallerFolder { get; set; } = null!;
+
+    /// <summary>
+    /// Master key used to AES-encrypt the per-resource <c>encryption_key</c> column at rest.
+    /// Required by AZ-183 constraint "encryption_key must be stored securely (... or via
+    /// application-level encryption)". Configure via <c>ResourcesConfig__EncryptionMasterKey</c>.
+    /// </summary>
+    public string EncryptionMasterKey { get; set; } = null!;
 }