feat(opcuaclient): #676 follow-ups — endpoint rewrite, stall wire test, fast definitive-loss recovery

- Endpoint rewrite: the driver now connects to the configured host AND port (scheme
  match, advertised path kept) instead of the server-advertised URL — fixes NAT/port-map
  upstreams and lets an in-test proxy carry the session (SDK SelectEndpoint rule).
- TcpStallProxy + OpcUaClientDriverStallWireTests: the in-place blip (#670) is now
  wire-tested on loopback — one Bad, frozen read stamp, same session, identical value
  republished Good, a post-recovery change arrives, no source-time regression after
  the SDK's late backlog flush.
- Defect found by that test, fixed: a change published right after a stall rode a
  Publish response the SDK timed out and never republished, leaving the node Good on
  the pre-change value indefinitely. New trailing reconcile read (Timeout +
  KeepAliveInterval after recovery) publishes any Good value newer than the last
  accepted one, through the replay guard's mark.
- IDriverConnectionLossSource (Core.Abstractions): opt-in definitive-loss signal.
  DriverInstanceActor attaches in PreStart / detaches in PostStop and turns a raise
  into a disconnect only while Connected. OpcUaClient raises once per session on
  keep-alive BadSessionIdInvalid/BadSessionClosed/BadSessionNotActivated/
  BadServerHalted (measured: the SDK never re-opens a halted channel) or a dropped
  subscription; ambiguous codes stay with the #527 watchdog.
- Replay guard: one Information summary per recovery when the window closes
  ("dropped N late notifications across M refs"), with a timer so quiet
  subscriptions log it too.
- ReconnectPeriod deleted (options, AdminUI form, docs, tests); stored configs that
  carry reconnectPeriod still parse in the factory, probe and browser.
- Docs: OpcUaClient.md, DriverLifecycle.md, driver-specs.md, CLAUDE.md.

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/OpcUaClientDriverReconnectWireTests.cs

@@ -13,6 +13,8 @@ namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests;
 ///     comms-loss watchdog trips on). Recovery is the watchdog's sequence, replayed here as <c>DriverInstanceActor</c>
 ///     runs it: ShutdownAsync, InitializeAsync, re-subscribe — after which the value comes back Good. There is no
 ///     in-driver reconnect any more (#670: the SDK reconnect handler kept everything Good and Healthy forever).
+///     Since #676 a gracefully stopped server is a DEFINITIVE loss (<c>BadServerHalted</c>), so the driver also raises
+///     <c>ConnectionLost</c> and the host runs that sequence at once instead of after the watchdog's silence window.
 /// </summary>
 [Trait("Category", "Integration")]
 public sealed class OpcUaClientDriverReconnectWireTests
@@ -39,6 +41,8 @@ public sealed class OpcUaClientDriverReconnectWireTests
         OpcUaClientDriverWireTests.Publish(rig, OpcUaClientDriverWireTests.SpeedId, 10.0f);
 
         await using var drv = OpcUaClientDriverWireTests.NewDriver(rig, "wire-reconnect");
+        var lost = new List<string>();
+        drv.ConnectionLost += (_, e) => { lock (lost) lost.Add(e.Reason); };
         await drv.InitializeAsync("{}", ct);
 
         var seen = new List<(uint Status, object? Value)>();
@@ -67,12 +71,20 @@ public sealed class OpcUaClientDriverReconnectWireTests
             frozen.ShouldNotBeNull();
             await Task.Delay(TimeSpan.FromSeconds(3), ct); // three keep-alive intervals
             drv.GetHealth().LastSuccessfulRead.ShouldBe(frozen);
+
+            // #676: a server that HALTED (graceful stop) is a definitive loss — measured here, the SDK reports
+            // BadServerHalted on every keep-alive and never re-opens the channel, so the session can never recover in
+            // place. The driver says so at once, so the host re-initialises it instead of waiting out the ~90 s watchdog.
+            await WaitAsync(() => { lock (lost) return lost.Count > 0; },
+                "a halted upstream must raise ConnectionLost", TimeSpan.FromSeconds(10));
+            lock (lost) lost.Single().ShouldContain("BadServerHalted");
         });
 
         // The restarted server knows nothing of the old session, so the driver stays down on its own …
         await Task.Delay(TimeSpan.FromSeconds(3), ct);
         drv.GetHealth().State.ShouldNotBe(DriverState.Healthy, "nothing in the driver may paper over a dead session");
         lock (seen) seen.Count(s => s.Status == BadNoCommunication).ShouldBe(1, "one Bad per outage, not per keep-alive");
+        lock (lost) lost.Count.ShouldBe(1, "once per session — the restarted server's continued refusals raise nothing more");
 
         // … until the host's comms-loss watchdog re-initialises it (DriverInstanceActor: Reconnecting → ShutdownAsync +
         // InitializeAsync → Connected → re-subscribe). The new server is empty: redeploy the nodes first, holding the
@@ -100,6 +112,7 @@ public sealed class OpcUaClientDriverReconnectWireTests
         var back = await drv.ReadAsync([OpcUaClientDriverWireTests.SpeedRef], ct);
         back[0].StatusCode.ShouldBe(0u);
         Convert.ToSingle(back[0].Value).ShouldBe(88.0f);
+        lock (lost) lost.Count.ShouldBe(1, "the healthy re-initialised session reports no loss");
     }
 
     /// <summary>
@@ -117,6 +130,8 @@ public sealed class OpcUaClientDriverReconnectWireTests
         OpcUaClientDriverWireTests.Publish(rig, OpcUaClientDriverWireTests.SpeedId, 5.0f);
 
         await using var drv = OpcUaClientDriverWireTests.NewDriver(rig, "wire-sublost");
+        var lost = new List<string>();
+        drv.ConnectionLost += (_, e) => { lock (lost) lost.Add(e.Reason); };
         await drv.InitializeAsync("{}", ct);
         var seen = new List<(uint Status, object? Value)>();
         drv.OnDataChange += (_, e) =>
@@ -140,6 +155,8 @@ public sealed class OpcUaClientDriverReconnectWireTests
         drv.GetHealth().State.ShouldNotBe(DriverState.Healthy, "… and must not revive a driver whose data plane is dead");
         drv.GetHealth().LastSuccessfulRead.ShouldBe(frozen);
         drv.GetHostStatuses().Single().State.ShouldBe(HostState.Running, "the session itself is fine");
+        // #676: a subscription the server dropped never comes back on this session — a definitive loss.
+        lock (lost) lost.ShouldHaveSingleItem().ShouldContain("subscription lost");
 
         // The watchdog's re-initialise recreates the subscription and the value comes back Good.
         await drv.ShutdownAsync(ct);