fix(security): pin the cached-key expiry guard, meter cache_hit after it, and close two wiring gaps (review fixes)

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs

@@ -307,12 +307,19 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     ///     </para>
     ///     <para>Separate from <see cref="StartAsync"/> so the timer's lifecycle is testable without booting the SDK.</para>
     /// </remarks>
-    internal void StartRevalidationTimer() =>
+    internal void StartRevalidationTimer()
+    {
+        // Dispose before overwriting. StartAsync runs again when a host restarts the service around the
+        // same instance, and an overwritten field would leave the previous timer armed with nothing left
+        // to dispose it — the same dispose-before-overwrite rule the driver reconnect paths carry.
+        _revalidationTimer?.Dispose();
+
         _revalidationTimer = new AclRevalidationTimer(
             () => _server?.NodeManager?.RevalidateMonitoredItems(),
             TimeSpan.FromSeconds(_aclOptions.RevalidationIntervalSeconds),
             _time,
             _loggerFactory.CreateLogger<AclRevalidationTimer>());
+    }
 
     /// <summary>
     /// Stops the OPC UA server asynchronously.