fix(mesh): gate follows the endpoint not the mode + review fixes

The known-cluster gate published only under Mode=Grpc, but the
interceptor it feeds is registered on every admin node and 1B maps
CentralCommandService by LISTENER PORT — neither consults the mode. A
dark-switch rollback to ClusterClient or Dps would therefore have left
that endpoint serving with the gate permanently inactive, silently
restoring both the timing oracle and the pre-auth secret-store/audit
flood, as a side effect of a rollback nobody would connect to
authentication. The gate is central's cluster inventory, not transport
state, so it is now decoupled from the mode entirely:

- SetKnownClusters + InvalidateAll run on EVERY successful contact load
  in EVERY mode, and the contact-refresh timer starts in all three.
  Under Dps this is a ConfigDb query every ContactRefreshSeconds that
  did not run before; central always has a ConfigDb, and one indexed
  read a minute is the cheaper half of the trade.
- The GATE set is built from ALL ClusterNode rows. The eligibility
  filter moved out of the query's WHERE and into the loop, so the FAN
  set is byte-for-byte what it was (enabled && !maintenance) while the
  gate widens. This also dissolves the maintenance coupling flagged in
  1A.2: a cluster whose nodes are all disabled or in maintenance can
  still ack, and refusing it would make maintenance mode an
  authentication switch. Central still refuses clusters it has never
  heard of.
- HandleContactsLoaded keeps a documented order — targets adopted, gate
  published, cache dropped — now pinned by test.

Guards: PreStart mirrors the null-dialer error for a null PSK provider
(silent absence is the worst outcome there — nothing malfunctions, so
nothing is investigated, while the gate never publishes and keys never
rotate); a failed contact load now says out loud that the gate is stale
and, before any load has succeeded, inactive; MeshGrpcCommandDialer
clamps a non-positive DispatchTimeoutSeconds to 10 with a construction
Warning, because the validator for that key is driver-role-scoped and a
pure-admin central reads it unvalidated; the dialer's local PSK refusal
was shortened so its remediation survives the actor's 200-char
truncation of remote-authored status detail; the portless-node warn-once
set is rebuilt each refresh, so a node that regains then loses a port
warns again — the regression is the occurrence worth seeing.

Docs/pins: dialer disposal comment no longer claims one-way; the two
interceptor-test comments claiming Matches has a default implementation
corrected (it deliberately has none); new pins for per-refresh
invalidation, the SetKnownClusters-before-InvalidateAll order, and one
channel per endpoint via a new CachedChannelCount.

The_known_cluster_set_is_not_published_by_the_other_two_modes is
replaced — its premise is obsolete — by three facts: every mode
publishes, gate set is a strict superset of the fan set, and the handler
ordering.

ControlPlane.Tests 230 -> 236, Host.Tests 92, Cluster.Tests 184,
0 warnings.

tests/Server/ZB.MOM.WW.OtOpcUa.Host.Tests/Configuration/CentralCommandAuthInterceptorTests.cs

@@ -248,8 +248,8 @@ public sealed class CentralCommandAuthInterceptorTests
         // Phase 1A security register item 2. The interceptor must not fetch the raw key and compare
         // it — that is how a constant-time comparison eventually becomes '=='. Matches owns the
         // comparison; TryGetPsk survives only for the DIAL side, which has to send the key.
-        // (The provider's own default Matches calls TryGetPsk internally; this fake overrides it, so
-        // a zero TryGetPsk count here means the INTERCEPTOR never asked for the key.)
+        // (The production provider's Matches calls TryGetPsk internally; this fake implements the two
+        // independently, so a zero TryGetPsk count here means the INTERCEPTOR never asked for the key.)
         var provider = new FakeMeshPskProvider(("SITE-A", "psk-site-a"));
         var interceptor = new CentralCommandAuthInterceptor(
             provider, NullLogger<CentralCommandAuthInterceptor>.Instance);
@@ -279,8 +279,10 @@ public sealed class CentralCommandAuthInterceptorTests
         }
 
         /// <summary>
-        ///     Overrides the interface's default so the two calls are separately countable. The
-        ///     semantics are the default's: no key, or a key that is not exactly the presented token.
+        ///     Implemented independently of <see cref="TryGetPsk"/> so the two calls are separately
+        ///     countable — the interface declares this with no default implementation, deliberately.
+        ///     Semantics match the production provider's: no key, or a key that is not exactly the
+        ///     presented token.
         /// </summary>
         public bool Matches(string clusterId, string presented)
         {