Resolve 6 of 7 stability review findings and close test coverage gaps

Fixes P1 StaComThread hang (crash-path faulting via WorkItem queue), P1 subscription
fire-and-forget (block+log or ContinueWith on 5 call sites), P2 continuation point
leak (PurgeExpired on Retrieve/Release), P2 dashboard bind failure (localhost prefix,
bool Start), P3 background loop double-start (task handles + join on stop in 3 files),
and P3 config logging exposure (SqlConnectionStringBuilder password masking). Adds
FakeMxAccessClient fault injection and 12 new tests. Documents required runtime
assemblies in ServiceHosting.md.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/ZB.MOM.WW.LmxOpcUa.Tests/OpcUa/LmxNodeManagerSubscriptionFaultTests.cs

@@ -0,0 +1,104 @@
+using System;
+using System.Threading.Tasks;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.LmxOpcUa.Tests.Helpers;
+
+namespace ZB.MOM.WW.LmxOpcUa.Tests.OpcUa
+{
+    /// <summary>
+    ///     Verifies that subscription and unsubscription failures in the MXAccess client
+    ///     are handled gracefully by the node manager instead of silently lost.
+    /// </summary>
+    public class LmxNodeManagerSubscriptionFaultTests
+    {
+        /// <summary>
+        ///     Confirms that a faulted SubscribeAsync is caught and logged rather than silently discarded.
+        /// </summary>
+        [Fact]
+        public async Task SubscribeTag_WhenClientFaults_DoesNotThrowAndDoesNotHang()
+        {
+            var mxClient = new FakeMxAccessClient
+            {
+                SubscribeException = new InvalidOperationException("COM connection lost")
+            };
+            var fixture = OpcUaServerFixture.WithFakeMxAccessClient(mxClient);
+            await fixture.InitializeAsync();
+            try
+            {
+                var nodeManager = fixture.Service.NodeManagerInstance!;
+
+                // SubscribeTag should catch the fault — not throw and not hang
+                Should.NotThrow(() => nodeManager.SubscribeTag("TestMachine_001.MachineID"));
+            }
+            finally
+            {
+                await fixture.DisposeAsync();
+            }
+        }
+
+        /// <summary>
+        ///     Confirms that a faulted UnsubscribeAsync is caught and logged rather than silently discarded.
+        /// </summary>
+        [Fact]
+        public async Task UnsubscribeTag_WhenClientFaults_DoesNotThrowAndDoesNotHang()
+        {
+            var mxClient = new FakeMxAccessClient();
+            var fixture = OpcUaServerFixture.WithFakeMxAccessClient(mxClient);
+            await fixture.InitializeAsync();
+            try
+            {
+                var nodeManager = fixture.Service.NodeManagerInstance!;
+
+                // Subscribe first (succeeds)
+                nodeManager.SubscribeTag("TestMachine_001.MachineID");
+                mxClient.ActiveSubscriptionCount.ShouldBe(1);
+
+                // Now inject fault for unsubscribe
+                mxClient.UnsubscribeException = new InvalidOperationException("COM connection lost");
+
+                // UnsubscribeTag should catch the fault — not throw and not hang
+                Should.NotThrow(() => nodeManager.UnsubscribeTag("TestMachine_001.MachineID"));
+            }
+            finally
+            {
+                await fixture.DisposeAsync();
+            }
+        }
+
+        /// <summary>
+        ///     Confirms that subscription failure does not corrupt the ref-count bookkeeping,
+        ///     allowing a retry to succeed after the fault clears.
+        /// </summary>
+        [Fact]
+        public async Task SubscribeTag_AfterFaultClears_CanSubscribeAgain()
+        {
+            var mxClient = new FakeMxAccessClient
+            {
+                SubscribeException = new InvalidOperationException("transient fault")
+            };
+            var fixture = OpcUaServerFixture.WithFakeMxAccessClient(mxClient);
+            await fixture.InitializeAsync();
+            try
+            {
+                var nodeManager = fixture.Service.NodeManagerInstance!;
+
+                // First subscribe faults (caught)
+                nodeManager.SubscribeTag("TestMachine_001.MachineID");
+                mxClient.ActiveSubscriptionCount.ShouldBe(0); // subscribe failed
+
+                // Clear the fault
+                mxClient.SubscribeException = null;
+
+                // Unsubscribe to reset ref count, then subscribe again
+                nodeManager.UnsubscribeTag("TestMachine_001.MachineID");
+                nodeManager.SubscribeTag("TestMachine_001.MachineID");
+                mxClient.ActiveSubscriptionCount.ShouldBe(1);
+            }
+            finally
+            {
+                await fixture.DisposeAsync();
+            }
+        }
+    }
+}