refactor(acl): delete the LDAP data-plane authenticator and its tests (#520)

Stage 2b. LdapOpcUaUserAuthenticator was left registered nowhere by stage 2a;
this removes it, its three test files, and the config surface that existed only
to serve it.

Deleted: LdapOpcUaUserAuthenticator, LdapOpcUaUserAuthenticatorTests,
LdapAuthResilienceTests, LdapGlauthOutageLiveTests (19 tests).

Also removed four Security:Ldap keys — AuthTimeoutMs,
MaxConcurrentAuthentications, OutageFailureThreshold, OutageCooldownSeconds —
plus their validator rules and binding/validator test coverage. Verified first
that the ONLY consumers were the deleted class and the validator rules asserting
them; none appear in any checked-in appsettings. Leaving them would have created
exactly the dead-config surface #521/#524/#525 were filed to clear up.

Worth stating why that resilience machinery does not need relocating rather than
just deleting. It existed because the OPC UA SDK raises impersonation
SYNCHRONOUSLY under a SessionManager-wide event lock, so a hung LDAP bind there
serialized every session activation server-wide — Anonymous and X509 included.
Key verification is one indexed lookup plus one HMAC with no network I/O, so the
hazard the wall-clock bound, concurrency cap and outage circuit guarded against
no longer exists on that path. LDAP now runs only on AdminUI login, an ordinary
async request path where a slow directory affects the one request making it.

ConnectionTimeoutMs is RETAINED: it is projected into the shared library and is
not authenticator-specific.

Docs corrected rather than left to rot:
- CLAUDE.md's "LDAP Authentication" section described the deleted file as the
  data-plane authenticator. Rewritten, including a warning not to "restore" it on
  seeing the LDAP wiring that AdminUI legitimately still needs.
- infra/README §5b (the GLAuth outage live gate) marked RETIRED with the reason,
  rather than silently dropped — the harness GLAuth is still used by
  OTOPCUA_HARNESS_USE_LDAP=1 and is unaffected.
- docs/security.md's five-key resilience table cut to the one surviving key, and
  a new API-key identity section added.
Historical archreview/ records are left as-is; they are dated accounts.

Host.IntegrationTests 211 tests (was 230, i.e. exactly the 19 removed) with the
same 3 pre-existing failures verified against clean master. Host 37, Security 89.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/LdapOptionsValidatorTests.cs

@@ -220,79 +220,6 @@ public sealed class LdapOptionsValidatorTests
         Sut.Validate(null, options).Failed.ShouldBeTrue();
     }
 
-    /// <summary>Enabled with a non-positive <c>AuthTimeoutMs</c> fails validation (03/S2).</summary>
-    [Fact]
-    public void Enabled_with_nonpositive_AuthTimeoutMs_fails()
-    {
-        var options = new LdapOptions
-        {
-            Enabled = true,
-            Server = "ldap",
-            SearchBase = "dc=x",
-            Port = 389,
-            Transport = LdapTransport.Ldaps,
-            AuthTimeoutMs = 0,
-        };
-
-        Sut.Validate(null, options).Failed.ShouldBeTrue();
-    }
-
-    /// <summary>Enabled with a non-positive <c>MaxConcurrentAuthentications</c> fails validation (03/S2).</summary>
-    [Fact]
-    public void Enabled_with_nonpositive_MaxConcurrentAuthentications_fails()
-    {
-        var options = new LdapOptions
-        {
-            Enabled = true,
-            Server = "ldap",
-            SearchBase = "dc=x",
-            Port = 389,
-            Transport = LdapTransport.Ldaps,
-            MaxConcurrentAuthentications = 0,
-        };
-
-        Sut.Validate(null, options).Failed.ShouldBeTrue();
-    }
-
-    /// <summary>A positive <c>OutageFailureThreshold</c> with a zero <c>OutageCooldownSeconds</c> fails —
-    /// an open circuit with no cooldown would probe on every call (03/S2).</summary>
-    [Fact]
-    public void OutageFailureThreshold_positive_with_zero_cooldown_fails()
-    {
-        var options = new LdapOptions
-        {
-            Enabled = true,
-            Server = "ldap",
-            SearchBase = "dc=x",
-            Port = 389,
-            Transport = LdapTransport.Ldaps,
-            OutageFailureThreshold = 3,
-            OutageCooldownSeconds = 0,
-        };
-
-        Sut.Validate(null, options).Failed.ShouldBeTrue();
-    }
-
-    /// <summary>A zero <c>OutageFailureThreshold</c> (circuit disabled) passes regardless of the
-    /// cooldown value (03/S2).</summary>
-    [Fact]
-    public void OutageFailureThreshold_zero_disables_circuit_and_passes()
-    {
-        var options = new LdapOptions
-        {
-            Enabled = true,
-            Server = "ldap",
-            SearchBase = "dc=x",
-            Port = 389,
-            Transport = LdapTransport.Ldaps,
-            OutageFailureThreshold = 0,
-            OutageCooldownSeconds = 0,
-        };
-
-        Sut.Validate(null, options).Succeeded.ShouldBeTrue();
-    }
-
-    /// <summary>Enabled with port 0 reports the port-range failure using the shared primitive wording.</summary>
     [Fact]
     public void Enabled_with_zero_port_fails()
     {