feat(cluster): SelfFormAfter option (bootstrap self-form fallback window)

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

src/Core/ZB.MOM.WW.OtOpcUa.Cluster/AkkaClusterOptions.cs

@@ -55,4 +55,19 @@ public sealed class AkkaClusterOptions
     ///     </para>
     /// </remarks>
     public string SplitBrainResolverStrategy { get; set; } = "auto-down";
+
+    /// <summary>
+    /// Bootstrap self-form fallback window (decision 2026-07-22, scadaproj/akka_failover.md §6.1).
+    /// Akka only lets the FIRST listed seed form a new cluster; a non-first seed cold-starting
+    /// while its peer is down loops on InitJoin forever ("auto-down removes the crash outage,
+    /// not this one" — docs/Redundancy.md). When this node has waited longer than this window
+    /// without cluster membership it joins itself — but ONLY if its own address appears in
+    /// <see cref="SeedNodes"/>; a non-seed node (e.g. a site node whose only seed is central-1)
+    /// stays waiting, because self-forming there creates a permanent island. Default 10s
+    /// (same-datacenter pair; a live peer answers InitJoin in milliseconds). <c>null</c> or a
+    /// non-positive value disables the fallback. Accepted trade: both pair nodes cold-starting
+    /// inside the window while mutually unreachable form two clusters — the same dual-active
+    /// class the auto-down strategy already accepts, same recovery (restart one side).
+    /// </summary>
+    public TimeSpan? SelfFormAfter { get; set; } = TimeSpan.FromSeconds(10);
 }