Auto: s7-e2 — PLC password / protection-level handling

Closes #303

docs/drivers/S7-Test-Fixture.md

@@ -109,6 +109,27 @@ or we ship a raw S7comm PDU helper. See
 [`docs/v2/s7.md` "CPU diagnostics (SZL)"](../v2/s7.md#cpu-diagnostics-szl)
 for the wire-status detail.
 
+### 7. Password / protection levels — not modelled by snap7
+
+PR-S7-E2 / [#303](https://github.com/dohertj2/lmxopcua/issues/303) adds
+`Password` + `ProtectionLevel` options that emit a connection-level password
+right after `OpenAsync`. **snap7 does not model S7 protection levels** — the
+simulator accepts every connection regardless of the password set on the
+client, so the integration profile cannot distinguish "password sent
+correctly" from "password ignored". Coverage stays at the unit-test seam:
+`S7PasswordOptionsTests` injects a fake `IS7PlcAuthGate` to assert the
+dispatch contract (Password=null skips the call; Password+SupportsSendPassword
+calls the gate; auth-failed wraps to a clean `InvalidOperationException`),
+plus the no-log invariant on `S7DriverOptions.ToString()`.
+
+The wire path is also fundamentally limited until S7netplus 0.20 exposes a
+public `SendPassword` — the driver currently logs a warning and continues
+when the API is missing. See
+[`docs/v2/s7.md` "PLC password / protection levels"](../v2/s7.md#plc-password--protection-levels)
+for the library-limitation note. Live-firmware coverage of the unlock path
+requires a hardened S7-1500 lab rig with TIA Portal "Protection & Security"
+configured, which is parked as a follow-up.
+
 ## When to trust the S7 tests, when to reach for a rig
 
 | Question | Unit tests | Real PLC |