Default AutoAcceptUntrustedClientCertificates to false in both OpcUaServerOptions and Program.cs config fallback, aligning with docs/security.md; auto-accept is now explicitly opt-in for dev use only. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>