docs(opcuaclient): keep server host-name check opt-in; surface it in the Security panel (#837)

Owner decision 2026-11-11: certificateValidation.validateServerHostName stays
opt-in (unset = off). The AdminUI toggle moves from the "Subscriptions, limits &
discovery" panel to the Security panel beside mode/policy, with help text on the
NAT/IP caveat, IPv6 zone ids and the loose first-label match. Binding unchanged
(tri-state, "Default (off)" leaves the key absent). OpcUaClient.md states the
decision; drivers rule updated; source-scan test pins placement + caveats.

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

docs/drivers/OpcUaClient.md

@@ -189,8 +189,16 @@ Consequences:
 - Test Connect (`OpcUaClientDriverProbe`) only calls GetEndpoints on an unsecured discovery channel — no session, so no
   certificate or host-name check.
 
-**Policy: `certificateValidation.validateServerHostName`** (driver JSON; AdminUI driver form "Server host-name check";
-the browser reads the same JSON):
+**Decision (#837, owner, 2026-11-11): the check stays OPT-IN — unset means off, and it will not become a default.**
+Turning it on by default would refuse every NAT / port-published / connect-by-IP endpoint whose certificate does not
+list that exact host, and every link-local IPv6 endpoint, on upgrade; and because the match is loose (first label) it
+would not deliver the identity guarantee a default implies. Operators enable it per driver where trust is CA-issued
+and certificate names are fully-qualified and site-unique. The AdminUI shows the toggle in the driver form's
+**Security** panel (beside mode/policy) as "Server certificate host-name check", with help text covering the NAT/IP
+caveat, IPv6 zone ids and the loose first-label match.
+
+**Policy: `certificateValidation.validateServerHostName`** (driver JSON; AdminUI driver form, Security panel,
+"Server certificate host-name check"; the browser reads the same JSON):
 
 | Value | Meaning |
 |---|---|