feat(opcua): materialise SystemPlatform tags (Galaxy) as OPC UA variables

Closes the gap where Tag rows with EquipmentId=NULL + Namespace.Kind=SystemPlatform
(Galaxy hierarchy) existed in ConfigDb but were never surfaced in the OPC UA
address space. Now they materialise as Variable nodes under a folder named for
their FolderPath, browseable through any OPC UA client.

Layers touched:

- IOpcUaAddressSpaceSink: new EnsureVariable(nodeId, parentFolderId, displayName,
  dataType) signature on the sink interface, NullSink, DeferredSink, SdkSink.
- OtOpcUaNodeManager.EnsureVariable: creates a BaseDataVariableState parented
  under the named folder (or root), initial Value=null +
  StatusCode=BadWaitingForInitialData; resolves Tag.DataType strings to the
  matching OPC UA built-in NodeId. Idempotent.
- Phase7CompositionResult: new GalaxyTags collection of GalaxyTagPlan records
  carrying (TagId, DriverInstanceId, FolderPath, DisplayName, DataType,
  MxAccessRef). Constructor overloads keep existing call sites compiling.
- Phase7Composer.Compose: now takes Tag + Namespace inputs, filters for
  SystemPlatform-namespace tags with EquipmentId=NULL, emits GalaxyTagPlan
  rows with MXAccess ref "FolderPath.Name".
- Phase7Plan: new AddedGalaxyTags / RemovedGalaxyTags / ChangedGalaxyTags
  collections + GalaxyTagDelta record; IsEmpty + needsRebuild updated.
- Phase7Planner.Compute: diffs GalaxyTags by TagId via existing DiffById helper.
- DeploymentArtifact.ParseComposition: reads the Tags + Namespaces +
  DriverInstances arrays the ConfigComposer already emits, applies the same
  SystemPlatform filter, returns the same GalaxyTagPlan list as the composer
  so artifact-side and compose-side plans agree.
- Phase7Applier: new MaterialiseGalaxyTags pass that ensures one folder per
  distinct FolderPath then one Variable per tag. NodeId for the variable is
  "<FolderPath>.<Name>" matching the MXAccess ref so the future Galaxy
  SubscribeBulk wiring can address them directly.
- OpcUaPublishActor.RebuildAddressSpace: invokes MaterialiseGalaxyTags after
  MaterialiseHierarchy. _lastApplied initialiser updated for the new ctor.
- seed-clusters.sql: pre-existing TestMachine_001.TestAlarm001..003 rows
  needed no change — the composer/applier now picks them up automatically.

Verified end-to-end via docker-dev: deploy click → driver-a logs
"Phase7Applier: Galaxy tags materialised (tags=3, folders=1)" → OPC UA Client
CLI browses the three Variable nodes under TestMachine_001 folder. Reads
return BadWaitingForInitialData status (expected — Galaxy driver's
SubscribeBulk wiring to push values into the nodes is the remaining
follow-up).

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Applier.cs

@@ -64,16 +64,19 @@ public sealed class Phase7Applier
         }
 
         var changedCount =
-            plan.ChangedEquipment.Count + plan.ChangedDrivers.Count + plan.ChangedAlarms.Count;
+            plan.ChangedEquipment.Count + plan.ChangedDrivers.Count + plan.ChangedAlarms.Count +
+            plan.ChangedGalaxyTags.Count;
         var addedCount =
-            plan.AddedEquipment.Count + plan.AddedDrivers.Count + plan.AddedAlarms.Count;
+            plan.AddedEquipment.Count + plan.AddedDrivers.Count + plan.AddedAlarms.Count +
+            plan.AddedGalaxyTags.Count;
 
-        // Any add/remove of Equipment or ScriptedAlarm requires a real address-space rebuild.
-        // Driver-instance changes don't touch the address-space topology directly — they go
-        // through DriverHostActor's spawn-plan in Runtime.
+        // Any add/remove of Equipment, ScriptedAlarm, or Galaxy tag topology requires a real
+        // address-space rebuild. Driver-instance changes don't touch the address-space topology
+        // directly — they go through DriverHostActor's spawn-plan in Runtime.
         var needsRebuild =
             plan.AddedEquipment.Count > 0 || plan.RemovedEquipment.Count > 0 ||
-            plan.AddedAlarms.Count > 0 || plan.RemovedAlarms.Count > 0;
+            plan.AddedAlarms.Count > 0 || plan.RemovedAlarms.Count > 0 ||
+            plan.AddedGalaxyTags.Count > 0 || plan.RemovedGalaxyTags.Count > 0;
 
         if (needsRebuild)
         {
@@ -125,12 +128,55 @@ public sealed class Phase7Applier
             composition.UnsAreas.Count, composition.UnsLines.Count, composition.EquipmentNodes.Count);
     }
 
+    /// <summary>
+    ///     Materialise Galaxy / SystemPlatform-namespace tags from a composition snapshot:
+    ///     for each <see cref="GalaxyTagPlan"/>, ensure its FolderPath segment exists (a folder
+    ///     under the namespace root), then ensure a Variable node sits inside that folder for
+    ///     the leaf <see cref="GalaxyTagPlan.DisplayName"/>. Variable starts with BadWaitingForInitialData;
+    ///     the Galaxy driver's <c>OnDataChange</c> path fills the value in once SubscribeBulk lands.
+    ///     Idempotent.
+    /// </summary>
+    public void MaterialiseGalaxyTags(Phase7CompositionResult composition)
+    {
+        ArgumentNullException.ThrowIfNull(composition);
+        if (composition.GalaxyTags.Count == 0) return;
+
+        // Folders first — each distinct FolderPath becomes one folder under the root.
+        var foldersCreated = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var tag in composition.GalaxyTags)
+        {
+            if (string.IsNullOrWhiteSpace(tag.FolderPath)) continue;
+            if (!foldersCreated.Add(tag.FolderPath)) continue;
+            SafeEnsureFolder(tag.FolderPath, parentNodeId: null, displayName: tag.FolderPath);
+        }
+
+        // Variables: NodeId is "<FolderPath>.<DisplayName>" so it matches the MXAccess ref the
+        // Galaxy driver subscribes to. Browse-path lookup via OPC UA Translate is the canonical
+        // resolution; flat NodeId keeps the address space lookup cheap.
+        foreach (var tag in composition.GalaxyTags)
+        {
+            var nodeId = string.IsNullOrWhiteSpace(tag.FolderPath) ? tag.DisplayName : tag.MxAccessRef;
+            var parent = string.IsNullOrWhiteSpace(tag.FolderPath) ? null : tag.FolderPath;
+            SafeEnsureVariable(nodeId, parent, tag.DisplayName, tag.DataType);
+        }
+
+        _logger.LogInformation(
+            "Phase7Applier: Galaxy tags materialised (tags={Tags}, folders={Folders})",
+            composition.GalaxyTags.Count, foldersCreated.Count);
+    }
+
     private void SafeEnsureFolder(string nodeId, string? parentNodeId, string displayName)
     {
         try { _sink.EnsureFolder(nodeId, parentNodeId, displayName); }
         catch (Exception ex) { _logger.LogWarning(ex, "Phase7Applier: EnsureFolder threw for {Node}", nodeId); }
     }
 
+    private void SafeEnsureVariable(string nodeId, string? parentNodeId, string displayName, string dataType)
+    {
+        try { _sink.EnsureVariable(nodeId, parentNodeId, displayName, dataType); }
+        catch (Exception ex) { _logger.LogWarning(ex, "Phase7Applier: EnsureVariable threw for {Node}", nodeId); }
+    }
+
     private void SafeWriteAlarmState(string nodeId, bool active, bool acknowledged, DateTime ts)
     {
         try { _sink.WriteAlarmState(nodeId, active, acknowledged, ts); }