fix: bind OtOpcUa LdapOptions from real Security:Ldap section; gate validator on DevStubMode

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/LdapOptionsValidator.cs

@@ -7,7 +7,8 @@ namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
 ///     Fail-fast startup validator for <see cref="LdapOptions"/>, built on the shared
 ///     <c>ZB.MOM.WW.Configuration</c> <see cref="OptionsValidatorBase{TOptions}"/>. When LDAP login
 ///     is enabled, <c>Server</c> and <c>SearchBase</c> must be set and <c>Port</c> must be a valid
-///     TCP port; when disabled, all checks are skipped. <c>ServiceAccountDn</c>/<c>Password</c> are
+///     TCP port; when disabled — or when <c>DevStubMode</c> bypasses the real bind — all checks are
+///     skipped. <c>ServiceAccountDn</c>/<c>Password</c> are
 ///     intentionally not required — an empty pair selects the direct-bind path (see
 ///     <see cref="LdapOptions.ServiceAccountDn"/>). Failure messages carry the real <c>"Ldap:"</c>
 ///     section prefix matching the bound configuration section.
@@ -17,7 +18,10 @@ public sealed class LdapOptionsValidator : OptionsValidatorBase<LdapOptions>
     /// <inheritdoc />
     protected override void Validate(ValidationBuilder builder, LdapOptions options)
     {
-        if (!options.Enabled) return;
+        // Skip the real-LDAP field checks when LDAP login is disabled, or when the dev stub is
+        // active — DevStubMode bypasses the real bind entirely, so Server/SearchBase/Port are
+        // irrelevant and would otherwise force dev configs to carry meaningless placeholders.
+        if (!options.Enabled || options.DevStubMode) return;
 
         builder.RequireThat(!string.IsNullOrWhiteSpace(options.Server),
             "Ldap:Server is required when LDAP login is enabled.");

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/OpcUaApplicationHostOptionsValidator.cs

@@ -25,8 +25,9 @@ public sealed class OpcUaApplicationHostOptionsValidator : OptionsValidatorBase<
         builder.Required(o.PublicHostname, "OpcUa:PublicHostname");
         builder.Required(o.PkiStoreRoot, "OpcUa:PkiStoreRoot");
         builder.Port(o.OpcUaPort, "OpcUa:OpcUaPort");
-        // EnabledSecurityProfiles is typed IList<T>, which does not implement IReadOnlyCollection<T>;
-        // ToList() bridges to the shared MinCount primitive while preserving the count (and message).
+        // EnabledSecurityProfiles is declared as IList<T> — that interface does not derive from
+        // IReadOnlyCollection<T>, so it can't bind to MinCount's IReadOnlyCollection<T> parameter
+        // directly. ToList() bridges to the shared primitive while preserving the count (and message).
         builder.MinCount(o.EnabledSecurityProfiles?.ToList(), 1, "OpcUa:EnabledSecurityProfiles");
     }
 }