feat(iot-hub): gate widget Add-from-IoT-Hub action by tenant, refresh widget JSON

- Move the widget-types table add-action descriptors from the
  constructor into resolve() and gate "Add from IoT Hub" so it
  only appears for TENANT_ADMIN; sys-admins keep just the
  create-new / import options.
- Swap the iot_hub system widget JSON to its own dedicated image
  resource (iot_hub_system_widget_image.png) instead of reusing the
  dashboards placeholder, with the matching link / title /
  fileName / publicResourceKey / base64 data and reformatted tags
  block.

ui-ngx/src/app/modules/home/pages/widget/widget-types-table-config.resolver.ts

@@ -90,27 +90,6 @@ export class WidgetTypesTableConfigResolver  {
         entity => checkBoxCell(entity.deprecated))
     );
 
-    this.config.addActionDescriptors.push(
-      {
-        name: this.translate.instant('dashboard.create-new-widget'),
-        icon: 'insert_drive_file',
-        isEnabled: () => true,
-        onAction: ($event) => this.addWidgetType($event)
-      },
-      {
-        name: this.translate.instant('widget.import'),
-        icon: 'file_upload',
-        isEnabled: () => true,
-        onAction: ($event) => this.importWidgetType($event)
-      },
-      {
-        name: this.translate.instant('iot-hub.add-from-iot-hub'),
-        icon: 'store',
-        isEnabled: () => true,
-        onAction: (_$event) => this.addWidgetFromIotHub()
-      }
-    );
-
     this.config.cellActionDescriptors.push(
       {
         name: this.translate.instant('widget.export'),
@@ -160,6 +139,30 @@ export class WidgetTypesTableConfigResolver  {
   resolve(): EntityTableConfig<WidgetTypeInfo | WidgetTypeDetails> {
     this.config.tableTitle = this.translate.instant('widget.widgets');
     const authUser = getCurrentAuthUser(this.store);
+    this.config.addActionDescriptors = [
+      {
+        name: this.translate.instant('dashboard.create-new-widget'),
+        icon: 'insert_drive_file',
+        isEnabled: () => true,
+        onAction: ($event) => this.addWidgetType($event)
+      },
+      {
+        name: this.translate.instant('widget.import'),
+        icon: 'file_upload',
+        isEnabled: () => true,
+        onAction: ($event) => this.importWidgetType($event)
+      }
+    ];
+    if (authUser.authority === Authority.TENANT_ADMIN) {
+      this.config.addActionDescriptors.push(
+        {
+          name: this.translate.instant('iot-hub.add-from-iot-hub'),
+          icon: 'store',
+          isEnabled: () => true,
+          onAction: (_$event) => this.addWidgetFromIotHub()
+        }
+      );
+    }
     this.config.deleteEnabled = (widgetType) => this.isWidgetTypeEditable(widgetType, authUser.authority);
     this.config.entitySelectionEnabled = (widgetType) => this.isWidgetTypeEditable(widgetType, authUser.authority);
     this.config.detailsReadonly = (widgetType) => !this.isWidgetTypeEditable(widgetType, authUser.authority);