A.3 (auto-subscribe): SessionManager issues SubscribeAlarms on session open

Adds the missing trigger that activates the worker's wnwrap consumer.
Without this, every session opened in OK state but the consumer never
started, so AcknowledgeAlarm/QueryActiveAlarms returned "alarm consumer
not configured" forever.

New AlarmsOptions config block (under MxGateway:Alarms):
  - Enabled (default false): gates the auto-subscribe path so existing
    deployments without alarm configuration are unaffected.
  - SubscriptionExpression: explicit AVEVA expression like
    \<machine>\Galaxy!<area>.
  - DefaultArea: fallback used when SubscriptionExpression is empty;
    composes \$(MachineName)\Galaxy!$(DefaultArea).
  - RequireSubscribeOnOpen (default false): when true, an auto-subscribe
    failure faults the session; when false, the failure is logged and
    the session stays Ready (data subscriptions keep working, alarms
    return "not subscribed" until the operator retries).

SessionManager.OpenSessionAsync gains a TryAutoSubscribeAlarmsAsync hook
that runs after MarkReady. Skips when alarms are disabled; otherwise
builds a SubscribeAlarmsCommand, invokes it on the session's worker
client, and either logs the resulting status or escalates per
RequireSubscribeOnOpen. SessionManagerException is the failure mode for
the strict path so callers in MxAccessGatewayService surface it as
session-open-failed.

Tests: 7 new unit tests cover the disabled lane, expression-driven
subscribe, DefaultArea fallback, success path, soft-failure (require
off), strict-failure (require on), and missing-config-strict-throw.
Server suite total: 295 pass / 0 fail. Solution builds clean.

End-to-end alarms-over-gateway path is now live (with config). Open a
session against a gateway with Alarms.Enabled=true + a valid
SubscriptionExpression; the worker's wnwrap consumer auto-subscribes;
QueryActiveAlarms streams snapshots; AcknowledgeAlarm acks by GUID.
Reference→GUID resolution (AlarmAckByName worker command) and the live
dev-rig smoke test remain follow-ups.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/MxGateway.Server/Sessions/SessionManager.cs

@@ -87,6 +87,8 @@ public sealed class SessionManager : ISessionManager
             session.MarkReady();
             _metrics.SessionOpened();
 
+            await TryAutoSubscribeAlarmsAsync(session, cancellationToken).ConfigureAwait(false);
+
             return session;
         }
         catch (Exception exception)
@@ -396,4 +398,101 @@ public sealed class SessionManager : ISessionManager
 
         return Convert.ToBase64String(bytes);
     }
+
+    /// <summary>
+    ///     If <c>Alarms.Enabled</c> is configured, issue a
+    ///     <c>SubscribeAlarmsCommand</c> on the freshly-Ready session so the
+    ///     worker's wnwrap consumer starts polling. Failure handling is
+    ///     governed by <c>Alarms.RequireSubscribeOnOpen</c>:
+    ///     <list type="bullet">
+    ///         <item><description><c>true</c> — propagate the failure to fault the session.</description></item>
+    ///         <item><description><c>false</c> (default) — log a warning and let the session continue serving data subscriptions.</description></item>
+    ///     </list>
+    /// </summary>
+    private async Task TryAutoSubscribeAlarmsAsync(
+        GatewaySession session,
+        CancellationToken cancellationToken)
+    {
+        AlarmsOptions alarms = _options.Alarms;
+        if (!alarms.Enabled) return;
+
+        string subscription = ResolveAlarmSubscription(alarms);
+        if (string.IsNullOrWhiteSpace(subscription))
+        {
+            const string diagnostic =
+                "Alarms.Enabled is true but no SubscriptionExpression / DefaultArea is configured.";
+            if (alarms.RequireSubscribeOnOpen)
+            {
+                throw new SessionManagerException(
+                    SessionManagerErrorCode.OpenFailed, diagnostic);
+            }
+            _logger.LogWarning(
+                "Auto-subscribe skipped for session {SessionId}: {Diagnostic}",
+                session.SessionId, diagnostic);
+            return;
+        }
+
+        WorkerCommand command = new WorkerCommand
+        {
+            Command = new MxCommand
+            {
+                Kind = MxCommandKind.SubscribeAlarms,
+                SubscribeAlarms = new SubscribeAlarmsCommand
+                {
+                    SubscriptionExpression = subscription,
+                },
+            },
+            EnqueueTimestamp = Timestamp.FromDateTimeOffset(_timeProvider.GetUtcNow()),
+        };
+
+        try
+        {
+            WorkerCommandReply reply = await session.InvokeAsync(command, cancellationToken)
+                .ConfigureAwait(false);
+            ProtocolStatusCode? code = reply.Reply?.ProtocolStatus?.Code;
+            if (code != ProtocolStatusCode.Ok)
+            {
+                string diagnostic = reply.Reply?.DiagnosticMessage
+                    ?? reply.Reply?.ProtocolStatus?.Message
+                    ?? "Worker rejected SubscribeAlarms.";
+                if (alarms.RequireSubscribeOnOpen)
+                {
+                    throw new SessionManagerException(
+                        SessionManagerErrorCode.OpenFailed,
+                        $"Auto-subscribe failed for session {session.SessionId}: {diagnostic}");
+                }
+                _logger.LogWarning(
+                    "Auto-subscribe failed for session {SessionId} (status {StatusCode}): {Diagnostic}",
+                    session.SessionId, code, diagnostic);
+                return;
+            }
+            _logger.LogInformation(
+                "Alarm auto-subscribe succeeded for session {SessionId} on {Subscription}.",
+                session.SessionId, subscription);
+        }
+        catch (SessionManagerException)
+        {
+            throw;
+        }
+        catch (Exception ex) when (!alarms.RequireSubscribeOnOpen)
+        {
+            _logger.LogWarning(
+                ex,
+                "Auto-subscribe threw for session {SessionId} on {Subscription}; alarm path remains inactive.",
+                session.SessionId, subscription);
+        }
+    }
+
+    private static string ResolveAlarmSubscription(AlarmsOptions alarms)
+    {
+        if (!string.IsNullOrWhiteSpace(alarms.SubscriptionExpression))
+        {
+            return alarms.SubscriptionExpression;
+        }
+        if (!string.IsNullOrWhiteSpace(alarms.DefaultArea))
+        {
+            return $@"\\{Environment.MachineName}\Galaxy!{alarms.DefaultArea}";
+        }
+        return string.Empty;
+    }
 }