fix(server): resolve Low code-review findings (Server-004,006,008,012,014,015)

- Server-004: pass the role-derived display name to UserIdentity's base
  ctor (the SDK's DisplayName has no public setter) and drop the dead
  Display property; make RoleBasedIdentity internal sealed.
- Server-006: derive a bounded CancellationToken from the SDK's
  OperationContext.OperationDeadline in OnReadValue / OnWriteValue so a
  stalled driver call can no longer pin the request thread.
- Server-008: mark handled slots via CallMethodRequest.Processed = true
  in RouteScriptedAlarmMethodCalls (the SDK skips on Processed, not on a
  Good error slot).
- Server-012: PeerHttpProbeLoop.ProbeAsync stops mutating client.Timeout
  per call; uses a per-request CancellationTokenSource linked to the
  shutdown token instead.
- Server-014: wire SealedBootstrap into Program.cs via AddSealedBootstrap
  + OpcUaServerService so the generation-sealed cache + stale-config flag
  + resilient reader actually run; /healthz now reflects cache-fallback
  state.
- Server-015: replace the stale 'PR 16 / PR 17 minimum-viable scope'
  class summaries on OtOpcUaServer and OpcUaServerOptions with the
  shipped LDAP + anonymous-role + configurable security-profile prose.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Server/ZB.MOM.WW.OtOpcUa.Server/SealedBootstrap.cs

@@ -12,14 +12,17 @@ namespace ZB.MOM.WW.OtOpcUa.Server;
 ///     sealed snapshot to fall back to.
 /// </summary>
 /// <remarks>
-///     <para>Alongside the original <see cref="NodeBootstrap"/> (which uses the single-file
-///     <see cref="ILocalConfigCache"/>). Program.cs can switch to this one once operators are
-///     ready for the generation-sealed semantics. The original stays for backward compat
-///     with the three integration tests that construct <see cref="NodeBootstrap"/> directly.</para>
+///     <para>Server-014 — registered in DI via <c>ServerWiring.AddSealedBootstrap</c> and
+///     consumed by <c>OpcUaServerService</c>. The legacy <see cref="NodeBootstrap"/> stays
+///     registered alongside for the three integration tests that construct it directly, but
+///     production boots through this wrapper so <see cref="GenerationSealedCache"/> +
+///     <see cref="ResilientConfigReader"/> + <see cref="StaleConfigFlag"/> run on every
+///     start-up and <c>/healthz</c>'s <c>usingStaleConfig</c> reflects the cache-fallback
+///     state.</para>
 ///
 ///     <para>Closes release blocker #2 in <c>docs/v2/v2-release-readiness.md</c> — the
 ///     generation-sealed cache + resilient reader + stale-config flag ship as unit-tested
-///     primitives in PR #81 but no production path consumed them until this wrapper.</para>
+///     primitives in PR #81; this wrapper is the production consumer that wires them in.</para>
 /// </remarks>
 public sealed class SealedBootstrap
 {