Auto: s7-e2 — PLC password / protection-level handling

Closes #303

src/ZB.MOM.WW.OtOpcUa.Driver.S7/S7DriverFactoryExtensions.cs

@@ -85,6 +85,14 @@ public static class S7DriverFactoryExtensions
                 fallback: TsapMode.Auto),
             LocalTsap = dto.LocalTsap,
             RemoteTsap = dto.RemoteTsap,
+            // PR-S7-E2 / #303 — connection-level password + declarative protection-level
+            // hint. Password defaults to null (no auth) per the no-log invariant; an
+            // explicit empty-string in JSON also collapses to null so a "Password": ""
+            // typo doesn't try to send a 0-byte password to the PLC. ProtectionLevel
+            // defaults to Auto when the field is absent.
+            Password = string.IsNullOrEmpty(dto.Password) ? null : dto.Password,
+            ProtectionLevel = ParseEnum<ProtectionLevel>(dto.ProtectionLevel, driverInstanceId,
+                "ProtectionLevel", fallback: ProtectionLevel.Auto),
             ScanGroupIntervals = scanGroupMap,
             // PR-S7-D2 — UDT layout declarations referenced by tags whose UdtName is set.
             // Empty list when the config doesn't declare any UDTs (the typical scalar-only case).
@@ -264,6 +272,8 @@ public static class S7DriverFactoryExtensions
             RemoteTsap = options.RemoteTsap,
             ScanGroupIntervals = options.ScanGroupIntervals,
             Udts = options.Udts,
+            Password = options.Password,
+            ProtectionLevel = options.ProtectionLevel,
         };
     }
 
@@ -332,6 +342,26 @@ public static class S7DriverFactoryExtensions
         ///     See <c>docs/v2/s7.md</c> "UDT / STRUCT support" section.
         /// </summary>
         public List<S7UdtDto>? Udts { get; init; }
+
+        /// <summary>
+        ///     PR-S7-E2 / #303 — connection-level password emitted to the PLC right
+        ///     after <c>OpenAsync</c> succeeds and before the pre-flight PUT/GET probe
+        ///     runs. Default <c>null</c> = no password is sent (the standard case).
+        ///     <b>Secret:</b> never logged. See <c>docs/v2/s7.md</c> §"PLC password /
+        ///     protection levels" for the no-log invariant and the S7netplus 0.20
+        ///     library-limitation note.
+        /// </summary>
+        public string? Password { get; init; }
+
+        /// <summary>
+        ///     PR-S7-E2 / #303 — declarative hint about the protection scheme on the
+        ///     target PLC. One of <c>Auto</c> (default), <c>None</c>, <c>Level1</c>,
+        ///     <c>Level2</c>, <c>Level3</c> (S7-300/400), or <c>ConnectionMechanism</c>
+        ///     (S7-1200/1500). Surfaced via the driver-diagnostics RPC so a
+        ///     misconfigured "level 3 PLC seen as level 1" deployment is spottable
+        ///     from the Admin UI.
+        /// </summary>
+        public string? ProtectionLevel { get; init; }
     }
 
     internal sealed class S7TagDto