refactor(acl): delete the LDAP data-plane authenticator and its tests (#520)

Stage 2b. LdapOpcUaUserAuthenticator was left registered nowhere by stage 2a;
this removes it, its three test files, and the config surface that existed only
to serve it.

Deleted: LdapOpcUaUserAuthenticator, LdapOpcUaUserAuthenticatorTests,
LdapAuthResilienceTests, LdapGlauthOutageLiveTests (19 tests).

Also removed four Security:Ldap keys — AuthTimeoutMs,
MaxConcurrentAuthentications, OutageFailureThreshold, OutageCooldownSeconds —
plus their validator rules and binding/validator test coverage. Verified first
that the ONLY consumers were the deleted class and the validator rules asserting
them; none appear in any checked-in appsettings. Leaving them would have created
exactly the dead-config surface #521/#524/#525 were filed to clear up.

Worth stating why that resilience machinery does not need relocating rather than
just deleting. It existed because the OPC UA SDK raises impersonation
SYNCHRONOUSLY under a SessionManager-wide event lock, so a hung LDAP bind there
serialized every session activation server-wide — Anonymous and X509 included.
Key verification is one indexed lookup plus one HMAC with no network I/O, so the
hazard the wall-clock bound, concurrency cap and outage circuit guarded against
no longer exists on that path. LDAP now runs only on AdminUI login, an ordinary
async request path where a slow directory affects the one request making it.

ConnectionTimeoutMs is RETAINED: it is projected into the shared library and is
not authenticator-specific.

Docs corrected rather than left to rot:
- CLAUDE.md's "LDAP Authentication" section described the deleted file as the
  data-plane authenticator. Rewritten, including a warning not to "restore" it on
  seeing the LDAP wiring that AdminUI legitimately still needs.
- infra/README §5b (the GLAuth outage live gate) marked RETIRED with the reason,
  rather than silently dropped — the harness GLAuth is still used by
  OTOPCUA_HARNESS_USE_LDAP=1 and is unaffected.
- docs/security.md's five-key resilience table cut to the one surviving key, and
  a new API-key identity section added.
Historical archreview/ records are left as-is; they are dated accounts.

Host.IntegrationTests 211 tests (was 230, i.e. exactly the 19 removed) with the
same 3 pre-existing failures verified against clean master. Host 37, Security 89.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/LdapOptions.cs

@@ -88,44 +88,18 @@ public sealed class LdapOptions
     ///     per-operation search inside a single bind flow. Projected into the library's
     ///     <see cref="LibLdapOptions.ConnectionTimeoutMs"/> via <see cref="ToLibraryOptions"/>. The
     ///     default (10000) matches the library default, so behaviour is unchanged unless configured.
-    ///     This is the FIRST line of defence against a directory outage; the whole-flow
-    ///     <see cref="AuthTimeoutMs"/> is the backstop (03/S2).
     /// </summary>
+    /// <remarks>
+    ///     This is now the ONLY directory-outage bound. Its former backstops — <c>AuthTimeoutMs</c>,
+    ///     <c>MaxConcurrentAuthentications</c>, <c>OutageFailureThreshold</c> and
+    ///     <c>OutageCooldownSeconds</c> — were removed with <c>LdapOpcUaUserAuthenticator</c> in #520
+    ///     (see the note on this type). They existed because an LDAP bind ran inline on OPC UA session
+    ///     activation, under a SessionManager-wide lock; nothing on the remaining AdminUI login path has
+    ///     that property, so they had no consumer left. Setting any of them in configuration is now
+    ///     silently ignored rather than an error, which is how options binding treats unknown keys.
+    /// </remarks>
     public int ConnectionTimeoutMs { get; set; } = 10_000;
 
-    /// <summary>
-    ///     Hard whole-flow wall-clock bound (in milliseconds) the OPC UA data-plane authenticator
-    ///     (<c>LdapOpcUaUserAuthenticator</c>) applies across the ENTIRE authenticate flow — bind plus
-    ///     role-map — so the OPC UA SDK's synchronous impersonation callback (raised under a
-    ///     <c>SessionManager</c>-wide event lock) can never be wedged by a slow / hung directory.
-    ///     Deliberately &gt; <see cref="ConnectionTimeoutMs"/> (default 15000) so a healthy-but-slow
-    ///     full flow is not cut off while an outage is bounded by the library timeout first (03/S2).
-    /// </summary>
-    public int AuthTimeoutMs { get; set; } = 15_000;
-
-    /// <summary>
-    ///     Maximum number of in-flight OPC UA authentication flows the data-plane authenticator admits
-    ///     at once. A caller that cannot acquire a slot within its budget is denied "backend busy"
-    ///     (local backpressure, not counted against the outage circuit). Bounds accumulation of
-    ///     orphaned / timed-out bind tasks during an outage (03/S2). Default 8.
-    /// </summary>
-    public int MaxConcurrentAuthentications { get; set; } = 8;
-
-    /// <summary>
-    ///     Number of CONSECUTIVE system-side failures (boundary timeout, directory-unreachable result,
-    ///     or unexpected throw) after which the data-plane authenticator's outage circuit opens and
-    ///     denies instantly for <see cref="OutageCooldownSeconds"/> without touching LDAP. Any success
-    ///     or user-side (credential) deny resets the counter. <c>0</c> disables the circuit (03/S2).
-    ///     Default 3.
-    /// </summary>
-    public int OutageFailureThreshold { get; set; } = 3;
-
-    /// <summary>
-    ///     How long (in seconds) the outage circuit stays open before a half-open probe is allowed
-    ///     through. Only meaningful when <see cref="OutageFailureThreshold"/> &gt; 0. Default 15 (03/S2).
-    /// </summary>
-    public int OutageCooldownSeconds { get; set; } = 15;
-
     /// <summary>
     ///     Projects the wire fields onto the shared <c>ZB.MOM.WW.Auth.Ldap</c>
     ///     <see cref="LibLdapOptions"/> the directory client consumes. App-only concerns

src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs

@@ -57,7 +57,7 @@ public static class ServiceCollectionExtensions
 
         // Singleton — OtOpcUaLdapAuthService is stateless (the shared-library directory client it
         // wraps opens/disposes an LdapConnection per call) and must be consumable by the Singleton
-        // LdapOpcUaUserAuthenticator on driver-role nodes. This is the app's ILdapAuthService: it
+        // AdminUI login on admin-role nodes. This is the app's ILdapAuthService: it
         // adds the Enabled master switch + DevStubMode bypass on top of the shared ZB.MOM.WW.Auth.Ldap
         // service. TryAdd so a fused admin+driver node (which also registers it in Program.cs for the
         // driver path) ends up with exactly one descriptor regardless of registration order.
@@ -65,7 +65,7 @@ public static class ServiceCollectionExtensions
 
         // Shared ZB.MOM.WW.Auth group→role mapper seam. Wraps the existing RoleMapper.Map +
         // RoleMapper.Merge logic; consumed by AuthEndpoints.cs (/auth/login) and by
-        // LdapOpcUaUserAuthenticator (OPC UA UserName session auth). Scoped to match
+        // AdminUI login (the OPC UA data plane uses API keys since #520). Scoped to match
         // ILdapGroupRoleMappingService (DbContext-backed, registered Scoped) — a singleton here
         // would capture the scoped DB service.
         services.TryAddScoped<IGroupRoleMapper<string>, OtOpcUaGroupRoleMapper>();