feat(modbus): wire Family / MelsecSubFamily / DisableFC23, and the form's timing keys

U1: a tag's addressString (Modicon / mnemonic / DL205 V-memory / MELSEC
D-X-Y grammar) now resolves through ModbusAddressParser with the DRIVER's
Family and MelsecSubFamily at every initialize and is authoritative; the
family-unaware gates (deploy Inspect, AdminUI parse consult) accept what
some family resolves. The tag editor gets an address-text field that
resolves with the owning driver's family and persists both the string and
the resolved region/offset/type fields; a hand edit drops the string.
DisableFC23 now gates FC23: by default a 2..121-register holding write is
one FC23 write + read-back (a unit answering exception 01, or failing FC23 at
the transport, moves to FC16 for the rest of the generation); RTU framing
deframes the FC23 reply. Live-checked: the pymodbus fixture implements FC23.
Also: the AdminUI driver form serialises ModbusDriverOptions (TimeSpan
strings), which the factory DTO never read - every timing field on the form
was dead. The DTO now accepts both shapes (*Ms keys win).

Refs #741
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -533,7 +533,7 @@ public sealed class ModbusDriver
             _skippedTags.BeginRebuild(_options.RawTags.Count);
             foreach (var entry in _options.RawTags)
             {
-                if (ModbusTagDefinitionFactory.FromTagConfig(entry.TagConfig, entry.RawPath, out var def))
+                if (ModbusTagDefinitionFactory.FromTagConfig(entry.TagConfig, entry.RawPath, _options.Family, _options.MelsecSubFamily, out var def))
                     table[entry.RawPath] = def with { WriteIdempotent = entry.WriteIdempotent };
                 else
                 {
@@ -556,6 +556,7 @@ public sealed class ModbusDriver
                 _transport = transport;
                 Volatile.Write(ref _tagsByRawPath, table);
                 Volatile.Write(ref _refusalWarned, new ConcurrentDictionary<string, byte>(StringComparer.Ordinal));
+                Volatile.Write(ref _fc23Unsupported, new ConcurrentDictionary<byte, byte>());
                 WriteHealth(new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null));
 
                 // PR 23: kick off the probe loop once the transport is up. Initial state stays
@@ -1619,6 +1620,7 @@ public sealed class ModbusDriver
                         throw new ModbusWriteRefusedException(StatusBadOutOfRange,
                             $"Write of {qty} registers to {tag.Name} exceeds MaxRegistersPerWrite={writeCap}. " +
                             $"Split the tag (e.g. shorter StringLength or smaller ArrayCount) — partial FC16 chunks would lose atomicity.");
+                    if (await TryWriteViaFc23Async(transport, tag, bytes, qty, ct).ConfigureAwait(false)) return;
                     var pdu = new byte[6 + 1 + bytes.Length];
                     pdu[0] = 0x10;
                     pdu[1] = (byte)(tag.Address >> 8); pdu[2] = (byte)(tag.Address & 0xFF);
@@ -1634,6 +1636,79 @@ public sealed class ModbusDriver
         }
     }
 
+    /// <summary>FC23's spec ceiling on the write quantity (0x79); larger multi-register writes use FC16.</summary>
+    private const ushort Fc23MaxWriteRegisters = 121;
+
+    /// <summary>
+    ///     Units that refused FC23 (exception 01) or failed it at the transport; their multi-register writes
+    ///     use FC16 for the rest of this driver generation. Replaced (never cleared in place) on re-init.
+    /// </summary>
+    private ConcurrentDictionary<byte, byte> _fc23Unsupported = new();
+
+    /// <summary>
+    ///     Multi-register write via FC23 (Read/Write Multiple Registers): the device writes the block and
+    ///     returns the SAME block read back in one transaction, so the write is confirmed by the device's own
+    ///     post-write registers. Gated by <see cref="ModbusDriverOptions.DisableFC23"/>. A device that does
+    ///     not implement FC23 (MELSEC QJ71MT91, S7 Modbus servers — exception 01) falls back to FC16 for this
+    ///     write and every later one on that unit, which is safe because an Illegal Function wrote nothing.
+    ///     A transport failure on FC23 is reported (its outcome is unknown, so it is not retried as FC16) and
+    ///     also moves the unit to FC16, so a gateway that cannot frame FC23 costs one failed write, not all.
+    ///     A read-back that differs from what was written (PLC logic overwrote it in the same scan, or the
+    ///     device clamped it) is logged once per tag; the write itself was accepted.
+    /// </summary>
+    /// <returns><see langword="true"/> when FC23 performed the write; <see langword="false"/> to use FC16.</returns>
+    private async Task<bool> TryWriteViaFc23Async(
+        IModbusTransport transport, ModbusTagDefinition tag, byte[] bytes, ushort qty, CancellationToken ct)
+    {
+        var unit = ResolveUnitId(tag);
+        var unsupported = Volatile.Read(ref _fc23Unsupported);
+        // Only genuinely multi-register writes: a single register forced onto FC16 (UseFC16ForSingleRegisterWrites)
+        // stays on the function code the operator named.
+        if (_options.DisableFC23 || qty < 2 || qty > Fc23MaxWriteRegisters || unsupported.ContainsKey(unit)) return false;
+
+        var pdu = new byte[10 + 1 + bytes.Length];
+        pdu[0] = 0x17;
+        pdu[1] = (byte)(tag.Address >> 8); pdu[2] = (byte)(tag.Address & 0xFF); // read start
+        pdu[3] = (byte)(qty >> 8); pdu[4] = (byte)(qty & 0xFF);                 // read quantity
+        pdu[5] = (byte)(tag.Address >> 8); pdu[6] = (byte)(tag.Address & 0xFF); // write start
+        pdu[7] = (byte)(qty >> 8); pdu[8] = (byte)(qty & 0xFF);                 // write quantity
+        pdu[9] = (byte)bytes.Length;
+        Buffer.BlockCopy(bytes, 0, pdu, 10, bytes.Length);
+
+        byte[] resp;
+        try
+        {
+            resp = await transport.SendAsync(unit, pdu, ct).ConfigureAwait(false);
+        }
+        catch (ModbusException mex) when (mex.ExceptionCode == 0x01)
+        {
+            if (unsupported.TryAdd(unit, 0))
+                _logger.LogInformation(
+                    "Modbus unit {Unit} does not implement FC23 (Illegal Function); multi-register writes use FC16. Driver={DriverInstanceId}",
+                    unit, _driverInstanceId);
+            return false;
+        }
+        catch (Exception ex) when (ex is not ModbusException && !(ex is OperationCanceledException && ct.IsCancellationRequested))
+        {
+            if (unsupported.TryAdd(unit, 0))
+                _logger.LogWarning(ex,
+                    "Modbus FC23 write to unit {Unit} failed at the transport; later multi-register writes to it use FC16. Driver={DriverInstanceId}",
+                    unit, _driverInstanceId);
+            throw;
+        }
+
+        // resp = [0x17][byteCount][read-back registers…]
+        if (resp.Length < 2 || resp[1] != bytes.Length || resp.Length < 2 + resp[1])
+            throw new InvalidDataException(
+                $"Modbus FC23 response for {tag.Name} malformed: expected {bytes.Length} read-back bytes, got {(resp.Length < 2 ? -1 : resp[1])}");
+        if (!resp.AsSpan(2, bytes.Length).SequenceEqual(bytes)
+            && Volatile.Read(ref _refusalWarned).TryAdd("fc23:" + tag.Name, 0))
+            _logger.LogWarning(
+                "Modbus FC23 read-back of {RawPath} differs from the value written (device logic or clamping changed it); the write was accepted. Driver={DriverInstanceId}",
+                tag.Name, _driverInstanceId);
+        return true;
+    }
+
     /// <summary>
     ///     Encode an array-typed write value into a contiguous byte block by encoding each
     ///     element with the scalar codec. Caller submits IList / Array of the element CLR type.