feat(mesh): node-side PSK interceptor

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -547,6 +547,12 @@ builder.Services.AddOtOpcUaObservability(builder.Configuration);
 // — the interceptor is the ONLY inbound auth on any endpoint (the libraries verify nothing).
 // Registered whenever either role is present so an admin-only node still serves config and a
 // driver-only node still gates sync + telemetry.
+//
+// MeshCommandAuthInterceptor (ClusterClient→gRPC migration) joins on the same terms: it gates the
+// node-side NodeCommandService and is registered NOW, a pure pass-through until Phase 1 maps that
+// service — an interceptor whose service is unmapped never sees a matching path. Registering it
+// alongside the service it gates would put a security gate's wiring in the same commit as the write
+// surface it protects; doing it here means the gate cannot be forgotten when that surface lights up.
 if (hasDriver || hasAdmin)
 {
     builder.Services.AddGrpc(o =>
@@ -555,6 +561,7 @@ if (hasDriver || hasAdmin)
         {
             o.Interceptors.Add<LocalDbSyncAuthInterceptor>();
             o.Interceptors.Add<TelemetryStreamAuthInterceptor>();
+            o.Interceptors.Add<MeshCommandAuthInterceptor>();
         }
         if (hasAdmin)
             o.Interceptors.Add<ConfigServeAuthInterceptor>();