PR 2: normalize DiagnosticsController auth; add Maintenance back-links

- DiagnosticsController: replaced raw [Authorize(Roles = "SuperAdmin,Administrator")] with [Authorize(Policy = SuperAdminOnly)] to match every other platform-admin controller; added PowderCoating.Shared.Constants using directive
- DataPurge, DataExport, StorageMigration, SeedData: added "← Maintenance" breadcrumb link at the top of each page so operators know they are in the guarded maintenance area and can navigate back to the hub

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Web/Controllers/DiagnosticsController.cs

@@ -1,11 +1,12 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using PowderCoating.Shared.Constants;
 using System.Reflection;
 using System.Security.Principal;
 
 namespace PowderCoating.Web.Controllers;
 
-[Authorize(Roles = "SuperAdmin,Administrator")]
+[Authorize(Policy = AppConstants.Policies.SuperAdminOnly)]
 public class DiagnosticsController : Controller
 {
     private readonly ILogger<DiagnosticsController> _logger;