feat(security): register TimeProvider + S18/S19 option knobs (archreview 03/S18,S19)

src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/AclOptions.cs

@@ -42,4 +42,23 @@ public sealed class AclOptions
     ///     false, which preserves the pre-stage-5 role gates byte-for-byte.
     /// </summary>
     public bool Enabled { get; set; }
+
+    /// <summary>
+    ///     How often, in seconds, live monitored items are re-authorized against the clock — in addition
+    ///     to on every deployment (arch-review 03/S19).
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         A subscription is authorized once and then streams, so before this a key that expired by the
+    ///         CLOCK kept feeding a live subscription until a deployment happened to advance the generation
+    ///         — indefinitely on a fleet that has been deployed once and left running. Every other seam
+    ///         re-asks per request and honours <c>ExpiresUtc</c> the moment it passes.
+    ///     </para>
+    ///     <para>
+    ///         <c>0</c> or negative disables the timer, leaving revalidation deploy-triggered only (the
+    ///         pre-R3-05 behaviour). The timer is <b>inert while <see cref="Enabled"/> is false</b>: the
+    ///         pass early-returns when ACL enforcement is off.
+    ///     </para>
+    /// </remarks>
+    public int RevalidationIntervalSeconds { get; set; } = 60;
 }

src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/ApiKeyOptions.cs

@@ -27,4 +27,29 @@ public sealed class ApiKeyOptions
     ///     <c>ApiKeySecret.ComputeHash</c> throws on one and this stays empty to make that fire early.
     /// </remarks>
     public string Pepper { get; set; } = string.Empty;
+
+    /// <summary>
+    ///     Hard per-call deadline, in milliseconds, on the API-key store lookup that runs inline on OPC UA
+    ///     session activation (arch-review 03/S18). Exceeding it <b>denies</b> the activation and emits a
+    ///     distinct Warning plus <c>otopcua.opcua.apikey_store.bounded{outcome=timeout}</c>.
+    /// </summary>
+    /// <remarks>
+    ///     <c>0</c> or negative disables the deadline, restoring the pre-R3-05 unbounded behaviour. Do not
+    ///     do that on a node with a ConfigDb: the SDK raises impersonation synchronously under a
+    ///     <c>SessionManager</c>-wide lock, so an unanswered lookup stalls <b>every</b> session activation
+    ///     in the server, not just its own.
+    /// </remarks>
+    public int StoreTimeoutMs { get; set; } = 2000;
+
+    /// <summary>
+    ///     TTL, in seconds, of the read-through cache in front of the API-key store (arch-review 03/S18).
+    ///     Bounds how long a revocation authored in the ConfigDb can take to reach a <b>new</b> session
+    ///     activation.
+    /// </summary>
+    /// <remarks>
+    ///     <c>0</c> or negative disables the cache, restoring a store read per activation. The window it
+    ///     introduces is strictly smaller than the one that already exists for <b>already-open</b> sessions
+    ///     on every node kind, which is the next deployment — see <c>docs/security.md</c>.
+    /// </remarks>
+    public int StoreCacheSeconds { get; set; } = 5;
 }