feat(dcl): Layer D OpcUaGlobalOptions for app-wide identity + cert paths

New deployment-wide options bound from the "OpcUa" section of appsettings.json:
- ApplicationName (default "ScadaLink-DCL")
- TrustedIssuerStorePath / TrustedPeerStorePath / RejectedCertificateStorePath

Empty paths fall back to Path.GetTempPath()/ScadaLink/pki/* so dev runs work
without explicit config — same defaults the hardcoded values previously used.

Wiring:
- ServiceCollectionExtensions binds OpcUaGlobalOptions to the OpcUa section.
- DataConnectionFactory takes IOptions<OpcUaGlobalOptions> and constructs
  RealOpcUaClientFactory with the snapshot.
- RealOpcUaClient(globalOptions) replaces the hardcoded ApplicationName and
  the three CertificateTrustList store paths in ApplicationConfiguration.
- Parameterless ctors on factory and client preserved for the existing test
  suite (32/32 DCL tests still green).

src/ScadaLink.DataConnectionLayer/OpcUaGlobalOptions.cs

@@ -0,0 +1,15 @@
+namespace ScadaLink.DataConnectionLayer;
+
+/// <summary>
+/// Deployment-wide OPC UA application identity. Bound from the "OpcUa" section
+/// of appsettings.json. Per-endpoint behavior lives on OpcUaEndpointConfig.
+/// Empty paths fall back to a default under Path.GetTempPath() so dev runs
+/// work without explicit configuration.
+/// </summary>
+public class OpcUaGlobalOptions
+{
+    public string ApplicationName { get; set; } = "ScadaLink-DCL";
+    public string TrustedIssuerStorePath { get; set; } = "";
+    public string TrustedPeerStorePath { get; set; } = "";
+    public string RejectedCertificateStorePath { get; set; } = "";
+}