Add configurable non-transparent OPC UA server redundancy

Separates ApplicationUri from namespace identity so each instance in a
redundant pair has a unique server URI while sharing the same Galaxy
namespace. Exposes RedundancySupport, ServerUriArray, and dynamic
ServiceLevel through the standard OPC UA server object. ServiceLevel
is computed from role (Primary/Secondary) and runtime health (MXAccess
and DB connectivity). Adds CLI redundancy command, second deployed
service instance, and 31 new tests including paired-server integration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/ServiceHosting.md

@@ -132,6 +132,25 @@ Log files are written relative to the executable directory (see Working Director
 
 `Log.CloseAndFlush()` is called in the `finally` block of `Program.Main()` to ensure all buffered log entries are written before process exit.
 
+## Multi-Instance Deployment
+
+The service supports running multiple instances for redundancy. Each instance requires:
+
+- A unique Windows service name (e.g., `LmxOpcUa`, `LmxOpcUa2`)
+- A unique OPC UA port and dashboard port
+- A unique `OpcUa.ApplicationUri` and `OpcUa.ServerName`
+- A unique `MxAccess.ClientName`
+- Matching `Redundancy.ServerUris` arrays on all instances
+
+Install additional instances using TopShelf's `-servicename` flag:
+
+```bash
+cd C:\publish\lmxopcua\instance2
+ZB.MOM.WW.LmxOpcUa.Host.exe install -servicename "LmxOpcUa2" -displayname "LMX OPC UA Server (Instance 2)"
+```
+
+See [Redundancy Guide](Redundancy.md) for full deployment details.
+
 ## Platform Target
 
 The service must be compiled and run as x86 (32-bit). The MXAccess COM toolkit DLLs in `Program Files (x86)\ArchestrA\Framework\bin` are 32-bit only. Running the service as x64 or AnyCPU (64-bit preferred) causes COM interop failures when creating the `LMXProxyServer` object on the STA thread.