fix(opcua-client): send UserName passwords in the legacy RSA format so 65-char API keys log in to SDK 1.5 servers (#880)

SDK 2.0.1's UserNameIdentityTokenHandler encrypts a password longer than 64 bytes
(a private RsaEncryptedSecretPasswordThreshold, no setting) as an RsaEncryptedSecret
with EncryptionAlgorithm=null. SDK 1.5.378 (.106 and .182) decrypts only the legacy
format under RSA policies; its SecurityPolicies.Decrypt answers a null algorithm with
BadIdentityTokenInvalid ("Unexpected encryption algorithm") before any key check.
Every production API key is 65 chars, so no SDK 2 OtOpcUa client could use one
against QA (b8b4c18f), a rollback target or an older third-party server.

LegacyRsaUserNameIdentityTokenHandler (Driver.OpcUaClient.Session, plugged in through
the public UserIdentity(IUserIdentityTokenHandler) ctor) always uses the legacy
format, RSA-OAEP(len|password|serverNonce) under the server certificate, under an RSA
policy. That is what SDK 2 sends for passwords of 64 bytes or less and what SDK 1.5
clients always send. The legacy format has no size limit (the plaintext is
length-framed over as many RSA blocks as it needs), and an SDK 2 server reads both
formats. Policy None, the ECC policies and a missing certificate go to the SDK
handler unchanged.

OpcUaUserIdentityFactory.UserName is now the one UserName identity the driver, the
AdminUI browse and Client.Shared (CLI/UI) present. Client.Shared references .Session
for it.

Tests: handler unit tests (all three RSA policies, the 1.5-required algorithm URI,
SDK 2 server-side decrypt, the session Copy() keeps the type, None unchanged, and an
SDK control pinning the 64/65-byte switch); a Client.Shared identity test; and an
SDK2<->SDK2 integration test where a 65-char key is admitted in both formats and a
wrong 65-char key reaches the key check (BadIdentityTokenRejected). The #800 Windows
gate's SDK 2 CLI 65-char case now gates against the 1.5 server too.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Fakes/FakeSessionFactory.cs

@@ -16,6 +16,8 @@ internal sealed class FakeSessionFactory : ISessionFactory
     public string? LastEndpointUrl { get; private set; }
     /// <summary>Gets the host-name-validation flag from the last CreateSessionAsync call (#816).</summary>
     public bool? LastValidateServerHostName { get; private set; }
+    /// <summary>Gets the user identity from the last CreateSessionAsync call (#880).</summary>
+    public UserIdentity? LastIdentity { get; private set; }
 
     /// <summary>
     /// Optional gate that, when set, blocks <see cref="CreateSessionAsync" /> until completed.
@@ -45,6 +47,7 @@ internal sealed class FakeSessionFactory : ISessionFactory
         CreateCallCount++;
         LastEndpointUrl = endpoint.EndpointUrl ?? string.Empty;
         LastValidateServerHostName = validateServerHostName;
+        LastIdentity = identity;
 
         // One-shot: the gate holds only the call that observed it, so a later call (e.g. a user's Connect while a
         // failover is held) runs freely.

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/OpcUaClientServiceTests.cs

@@ -81,6 +81,35 @@ public class OpcUaClientServiceTests : IDisposable
         _configFactory.LastSettings!.ValidateServerHostName.ShouldBe(validate ?? false);
     }
 
+    /// <summary>
+    /// Gitea #880: the CLI/UI present the driver's UserName identity, whose RSA-policy encryption is the legacy format,
+    /// so a 65-character API key also logs in to an SDK 1.5 server. SDK 2's own handler would send that key as an
+    /// RsaEncryptedSecret, which the 1.5 server rejects as BadIdentityTokenInvalid. The format itself is pinned in
+    /// Driver.OpcUaClient.Tests (LegacyRsaUserNameIdentityTokenHandlerTests); this pins that Client.Shared uses it.
+    /// </summary>
+    [Fact]
+    public async Task ConnectAsync_presents_the_legacy_format_UserName_identity()
+    {
+        var settings = ValidSettings();
+        settings.Username = "apikey";
+        settings.Password = "otua_" + new string('a', 16) + "_" + new string('b', 43);
+
+        await _service.ConnectAsync(settings, TestContext.Current.CancellationToken);
+
+        var handler = _sessionFactory.LastIdentity.ShouldNotBeNull().TokenHandler
+            .ShouldBeOfType<ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.LegacyRsaUserNameIdentityTokenHandler>();
+        handler.UserName.ShouldBe("apikey");
+    }
+
+    /// <summary>Without a user name the session stays anonymous (#880 changed only the UserName path).</summary>
+    [Fact]
+    public async Task ConnectAsync_without_a_username_stays_anonymous()
+    {
+        await _service.ConnectAsync(ValidSettings(), TestContext.Current.CancellationToken);
+
+        _sessionFactory.LastIdentity.ShouldNotBeNull().TokenType.ShouldBe(UserTokenType.Anonymous);
+    }
+
     /// <summary>
     /// Verifies that invalid connection settings fail validation before any OPC UA session is created.
     /// </summary>