Phase 6.2 Stream C — Browse gating on DriverNodeManager

Closes task #120 (partial — strict point-check; ancestor-visibility
implication is a follow-up).

Before this commit DriverNodeManager exposed every materialized node to
every browsing session regardless of the user's ACL. Read + Write +
HistoryRead were already gated through AuthorizationGate in Phase 6.2
Stream C core; Browse was the one surface where the session could still
enumerate nodes it had no permission to touch, discovering structure
even when reads failed with BadUserAccessDenied.

Implementation
- New `Browse` override on DriverNodeManager that calls base.Browse
  first (lets the stack populate the reference list normally), then
  post-filters the IList<ReferenceDescription> so denied nodes are
  removed silently. OPC UA convention: Browse filtering is invisible to
  the client; no BadUserAccessDenied surfaces.
- Extracted the filter loop into the static internal
  `FilterBrowseReferences(references, userIdentity, gate, scopeResolver)`
  so the policy is unit-testable without standing up the full OPC UA
  server stack.
- Non-string NodeId identifiers (stack-synthesized standard-type
  references with numeric identifiers) bypass the gate — only driver-
  materialized nodes key into the authz trie.
- When AuthorizationGate or NodeScopeResolver is null, the filter is a
  no-op — preserves the pre-Phase-6.2 dispatch path for integration
  tests that construct DriverNodeManager without authz.

Tests — 6 new in BrowseGatingTests.cs (gate-null no-op, empty-list
no-op, denied-removed, allowed-passes-through, numeric-id bypass,
lax-mode null-identity keeps references). Server.Tests 257 → 263.

Known follow-up (tracked implicitly under #120 re-scope):
- Ancestor-visibility implication (acl-design.md §Browse line 111): a
  user with Read at `Line/Tag` should be able to Browse `Line` even
  without an explicit Browse grant. Current filter does a strict
  point-check. Proper fix needs TriePermissionEvaluator to expose a
  "subtree-has-any-grant" query.
- TranslateBrowsePathsToNodeIds not yet filtered (same extension
  pattern; small follow-up).

Docs: v2-release-readiness.md Phase 6.2 Stream C hardening list marks
the Browse bullet struck-through with "Partial" close-out note.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs

@@ -276,6 +276,73 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
         return ServiceResult.Good;
     }
 
+    /// <summary>
+    ///     Phase 6.2 Stream C — Browse gating. Post-filters the reference list the base
+    ///     <see cref="CustomNodeManager2"/> produced so nodes the session isn't allowed to
+    ///     see disappear from the browse result silently (OPC UA convention: deny = omit,
+    ///     not an error).
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         Each surviving reference is a <see cref="ReferenceDescription"/>; we map its
+    ///         <see cref="ReferenceDescription.NodeId"/> back to the driver-side fullRef the
+    ///         node manager uses as its identifier, resolve a <see cref="NodeScope"/> via
+    ///         <see cref="NodeScopeResolver"/>, and ask <see cref="AuthorizationGate"/>
+    ///         whether <see cref="OpcUaOperation.Browse"/> is allowed for that scope.
+    ///     </para>
+    ///     <para>
+    ///         References with non-string NodeId identifiers (e.g. stack-synthesized numeric
+    ///         standard-type references) bypass the gate — only driver-materialized nodes
+    ///         key into <c>_variablesByFullRef</c> and carry an authz policy.
+    ///     </para>
+    ///     <para>
+    ///         Ancestor-visibility implication (a user with Read at <c>Line/Tag</c> should
+    ///         be able to browse <c>Line</c> even without an explicit Browse grant there) is
+    ///         a follow-up that needs the <c>TriePermissionEvaluator</c> to expose a
+    ///         "subtree-has-any-grant" query. For now this filter does a strict point check;
+    ///         admins grant Browse at the right levels in practice.
+    ///     </para>
+    /// </remarks>
+    public override void Browse(
+        OperationContext context,
+        ref ContinuationPoint continuationPoint,
+        IList<ReferenceDescription> references)
+    {
+        base.Browse(context, ref continuationPoint, references);
+        FilterBrowseReferences(references, context.UserIdentity, _authzGate, _scopeResolver);
+    }
+
+    /// <summary>
+    ///     Pure-function filter over a <see cref="ReferenceDescription"/> list. Extracted so
+    ///     the Browse-gate policy is unit-testable without standing up the OPC UA server
+    ///     stack. When either the gate or the resolver is <c>null</c>, the list is left
+    ///     untouched — matches the pre-Phase-6.2 no-authz path.
+    /// </summary>
+    /// <remarks>
+    ///     References whose <see cref="NodeId.Identifier"/> isn't a string (stack-synthesized
+    ///     standard-type references, numeric identifiers, etc.) bypass the gate — only
+    ///     driver-materialized nodes key into the authz trie.
+    /// </remarks>
+    internal static void FilterBrowseReferences(
+        IList<ReferenceDescription> references,
+        IUserIdentity? userIdentity,
+        AuthorizationGate? gate,
+        NodeScopeResolver? scopeResolver)
+    {
+        if (gate is null || scopeResolver is null) return;
+        if (references.Count == 0) return;
+
+        // Remove by index from the back so indices stay valid as we shrink the list.
+        for (var i = references.Count - 1; i >= 0; i--)
+        {
+            if (references[i].NodeId.Identifier is not string fullRef) continue;
+
+            var scope = scopeResolver.Resolve(fullRef);
+            if (!gate.IsAllowed(userIdentity, OpcUaOperation.Browse, scope))
+                references.RemoveAt(i);
+        }
+    }
+
     /// <summary>
     ///     Picks the <see cref="IReadable"/> the dispatch layer routes through based on the
     ///     node's Phase 7 source kind (ADR-002). Extracted as a pure function for unit test