feat(opcuaclient-browser): real AttributesAsync + certificate-auth browse (R06:O-5)

- AttributesAsync was a stub returning nothing; it now reads NodeClass /
  DisplayName / DataType / ValueRank / UserAccessLevel in one request and maps them
  through UpstreamAttributeMapping, the same mapping discovery registers with (moved
  into the shared .Session leaf; the driver forwards to it). Objects have no value
  attributes.
- Certificate auth was refused "in v1". The browse now builds its identity through
  OpcUaUserIdentityFactory (shared .Session leaf, the driver forwards to it),
  including the secret: resolution of Password / UserCertificatePassword through the
  host's ISecretResolver (optional ctor param, DI-injected). Fail-closed: a secret:
  ref with no store throws instead of being sent as the literal (the browse used to
  send a secret: Password verbatim). The identity is built before any network I/O.

Refs #743

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/OpcUaClientDriver.cs

@@ -967,15 +967,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
     /// <param name="options">Driver options containing authentication configuration.</param>
     /// <returns>The constructed <see cref="UserIdentity"/> for session activation.</returns>
     internal static UserIdentity BuildUserIdentity(OpcUaClientDriverOptions options) =>
-        options.AuthType switch
-        {
-            OpcUaAuthType.Anonymous => new UserIdentity(new AnonymousIdentityToken()),
-            OpcUaAuthType.Username => new UserIdentity(
-                options.Username ?? string.Empty,
-                System.Text.Encoding.UTF8.GetBytes(options.Password ?? string.Empty)),
-            OpcUaAuthType.Certificate => BuildCertificateIdentity(options),
-            _ => new UserIdentity(new AnonymousIdentityToken()),
-        };
+        OpcUaUserIdentityFactory.Build(options);
 
     /// <summary>
     ///     Open a session against a single endpoint URL. Bounded by
@@ -1095,30 +1087,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
     /// </summary>
     /// <param name="options">Driver options containing certificate configuration.</param>
     /// <returns>The certificate-backed <see cref="UserIdentity"/>.</returns>
-    internal static UserIdentity BuildCertificateIdentity(OpcUaClientDriverOptions options)
-    {
-        if (string.IsNullOrWhiteSpace(options.UserCertificatePath))
-            throw new InvalidOperationException(
-                "OpcUaAuthType.Certificate requires OpcUaClientDriverOptions.UserCertificatePath to be set.");
-        if (!System.IO.File.Exists(options.UserCertificatePath))
-            throw new System.IO.FileNotFoundException(
-                $"User certificate not found at '{options.UserCertificatePath}'.",
-                options.UserCertificatePath);
-
-        // X509CertificateLoader (new in .NET 9) is the only non-obsolete way to load a PFX
-        // since the legacy X509Certificate2 ctors are marked obsolete on net10. Passes the
-        // password through verbatim; PEM files with external keys fall back to
-        // LoadCertificateFromFile which picks up the adjacent .key if present.
-        var cert = System.Security.Cryptography.X509Certificates.X509CertificateLoader
-            .LoadPkcs12FromFile(options.UserCertificatePath, options.UserCertificatePassword);
-
-        if (!cert.HasPrivateKey)
-            throw new InvalidOperationException(
-                $"User certificate at '{options.UserCertificatePath}' has no private key — " +
-                "the private key is required to sign the OPC UA user-token challenge at session activation.");
-
-        return new UserIdentity(cert);
-    }
+    internal static UserIdentity BuildCertificateIdentity(OpcUaClientDriverOptions options) =>
+        OpcUaUserIdentityFactory.FromCertificate(options);
 
     /// <summary>Convert a driver <see cref="OpcUaSecurityPolicy"/> to the OPC UA policy URI.</summary>
     /// <param name="policy">The driver security policy to map.</param>
@@ -1804,7 +1774,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
             // array dimension). -3 ScalarOrOneDimension and -2 Any are conservatively treated
             // as scalar — array-of-one is exposed as scalar to the local address space until
             // the upstream variable carries a concrete dimensioned rank.
-            var isArray = valueRank >= 0;
+            var isArray = UpstreamAttributeMapping.IsArray(valueRank);
             var access = StatusCode.IsGood(accessDv.StatusCode) && accessDv.Value is byte ab ? ab : (byte)0;
             var securityClass = MapAccessLevelToSecurityClass(access);
             var historizing = StatusCode.IsGood(histDv.StatusCode) && histDv.Value is bool b && b;
@@ -1842,26 +1812,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
     /// </summary>
     /// <param name="dataType">The OPC UA data type NodeId to map.</param>
     /// <returns>The mapped <see cref="DriverDataType"/>.</returns>
-    internal static DriverDataType MapUpstreamDataType(NodeId dataType)
-    {
-        if (dataType == DataTypeIds.Boolean) return DriverDataType.Boolean;
-        // SByte (signed 8-bit) shares Int16 — DriverDataType has no narrower signed type.
-        // Byte (unsigned 8-bit) belongs in the unsigned family → UInt16, not Int16
-        // (mapping an unsigned 0-255 type onto Int16 misrepresents type metadata and
-        // confuses range/validation logic keyed off DriverDataType).
-        if (dataType == DataTypeIds.SByte || dataType == DataTypeIds.Int16) return DriverDataType.Int16;
-        if (dataType == DataTypeIds.Byte || dataType == DataTypeIds.UInt16) return DriverDataType.UInt16;
-        if (dataType == DataTypeIds.Int32) return DriverDataType.Int32;
-        if (dataType == DataTypeIds.UInt32) return DriverDataType.UInt32;
-        if (dataType == DataTypeIds.Int64) return DriverDataType.Int64;
-        if (dataType == DataTypeIds.UInt64) return DriverDataType.UInt64;
-        if (dataType == DataTypeIds.Float) return DriverDataType.Float32;
-        if (dataType == DataTypeIds.Double) return DriverDataType.Float64;
-        if (dataType == DataTypeIds.String) return DriverDataType.String;
-        if (dataType == DataTypeIds.DateTime || dataType == DataTypeIds.UtcTime)
-            return DriverDataType.DateTime;
-        return DriverDataType.String;
-    }
+    internal static DriverDataType MapUpstreamDataType(NodeId dataType) =>
+        UpstreamAttributeMapping.MapDataType(dataType);
 
     /// <summary>
     ///     Map an OPC UA AccessLevel/UserAccessLevel attribute value (<c>AccessLevels</c>
@@ -1871,13 +1823,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
     /// </summary>
     /// <param name="accessLevel">The OPC UA access level bitmask.</param>
     /// <returns>The mapped security classification.</returns>
-    internal static SecurityClassification MapAccessLevelToSecurityClass(byte accessLevel)
-    {
-        const byte CurrentWrite = 2; // AccessLevels.CurrentWrite = 0x02
-        return (accessLevel & CurrentWrite) != 0
-            ? SecurityClassification.Operate
-            : SecurityClassification.ViewOnly;
-    }
+    internal static SecurityClassification MapAccessLevelToSecurityClass(byte accessLevel) =>
+        UpstreamAttributeMapping.MapAccessLevel(accessLevel);
 
     // ---- ISubscribable ----