feat(security): LdapAuthResult.IsSystemFailure distinguishes directory outage from credential deny (03/S2)

src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs

@@ -113,7 +113,13 @@ public sealed class OtOpcUaLdapAuthService : ILdapAuthService
         if (result.Succeeded)
             return new(true, result.DisplayName, result.Username, result.Groups, [], null);
 
-        return new(false, null, username, [], [], FailureToError(result.Failure));
+        // ServiceAccountBindFailed is the library's directory-unreachable / service-account-misconfigured
+        // bucket (its enum has no dedicated DirectoryUnavailable) — flag it as system-side so the OPC UA
+        // authenticator's outage circuit can distinguish an outage from a user-credential deny (03/S2).
+        return new(false, null, username, [], [], FailureToError(result.Failure))
+        {
+            IsSystemFailure = result.Failure is LdapAuthFailure.ServiceAccountBindFailed,
+        };
     }
 
     /// <summary>Folds a structured library failure code into the app's user-facing error text.</summary>