feat(opcuaclient): opt-in server-certificate host-name check; NAT fixture keeps its PKI (#816, #818)

#816 finding: the SDK checks that the server certificate names the host only
when a session is created with checkDomain:true. The driver, the AdminUI
browser and Client.Shared all called the 8-argument
DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no
host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine
over an IP in #813). When enabled the SDK (Session.OpenAsync ->
ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost
— the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector
rewrote the advertised one — against the cert's DNS/IP SANs; secured
sessions only, and the auto-accept handler accepts a mismatch.

Policy: certificateValidation.validateServerHostName, tri-state. Unset =
OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the
pre-#816 behaviour, so nothing changes on upgrade; true = validate the
configured host; false = explicit NAT/port-publish opt-out. Threaded into the
driver, the AdminUI browser (same JSON) and the AdminUI form (a select that
keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName
and the CLI --validate-host-name. A driver refusal names the opt-out.

#818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified:
same thumbprint across --force-recreate), its PUBLIC cert is committed as
Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run
every secure browse on a throwaway PKI (internal browser seam): refusal with
nothing trusted, positive with the cert trusted (unset/false host check), and
a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is
OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch);
OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT
container's public cert. ServerHostNameValidationTests pin the driver against
the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in
v2-integration (440 -> 446), documented in scripts/ci/README.md.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/OpcUaClientDriverForm.razor

@@ -192,6 +192,15 @@
                 </div>
                 <div class="form-text">Revoked certificates are always rejected.</div>
             </div>
+            <div class="col-md-3">
+                <label class="form-label">Server host-name check</label>
+                <InputSelect @bind-Value="_form.OpcUa.ValidateServerHostName" @bind-Value:after="EmitAsync" class="form-select form-select-sm">
+                    <option value="">Default (off)</option>
+                    <option value="true">Validate configured host</option>
+                    <option value="false">Off (NAT / port publish)</option>
+                </InputSelect>
+                <div class="form-text">Secured sessions only: the server certificate must name the endpoint host you configured.</div>
+            </div>
             <div class="col-md-6">
                 <label class="form-label">Issuer store / CRL directory</label>
                 <InputText @bind-Value="_form.OpcUa.IssuerStorePath" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" />
@@ -349,6 +358,8 @@
         public int SubscriptionPriority { get; set; }
         public bool RejectUnknownRevocationStatus { get; set; }
         public string? IssuerStorePath { get; set; }
+        // #816 tri-state: "" = unset (the driver default) so the form never re-emits a concrete default; "true"/"false".
+        public string ValidateServerHostName { get; set; } = "";
         public string? DiscoveryUrl { get; set; }
         public string? DiscoveryServerUri { get; set; }
 
@@ -381,6 +392,12 @@
             SubscriptionPriority = r.SubscriptionPriority,
             RejectUnknownRevocationStatus = r.CertificateValidation.RejectUnknownRevocationStatus,
             IssuerStorePath = r.CertificateValidation.IssuerStorePath,
+            ValidateServerHostName = r.CertificateValidation.ValidateServerHostName switch
+            {
+                true => "true",
+                false => "false",
+                null => "",
+            },
             DiscoveryUrl = r.DiscoveryUrl,
             DiscoveryServerUri = r.DiscoveryServerUri,
         };
@@ -417,6 +434,12 @@
             {
                 RejectUnknownRevocationStatus = RejectUnknownRevocationStatus,
                 IssuerStorePath = string.IsNullOrWhiteSpace(IssuerStorePath) ? null : IssuerStorePath,
+                ValidateServerHostName = ValidateServerHostName switch
+                {
+                    "true" => true,
+                    "false" => false,
+                    _ => null,
+                },
             },
             DiscoveryUrl = string.IsNullOrWhiteSpace(DiscoveryUrl) ? null : DiscoveryUrl,
             DiscoveryServerUri = string.IsNullOrWhiteSpace(DiscoveryServerUri) ? null : DiscoveryServerUri,