Recover clients after server certificate rotation

[kevinherron]

Stacked on #1955, which carries the server half. Merge #1955 first; this PR's base will then move to integration/1.2.

Clients can recover after a server application certificate changes without replacing the client instance. An EndpointResolver repeats discovery and endpoint selection after SecureChannel establishment failures on a secured endpoint. URL-based client factories configure it automatically; directly constructed clients can supply their own resolver.

Refresh preserves the endpoint's URL, server identity, transport, security policy, security mode, and user token policies. Replacement certificates still pass the configured validator. Retained Sessions keep their original certificate inputs while reactivation uses the replacement channel's security bindings; the server side of that contract is in #1955.

Deferred requests have bounded channel waits and stay on the channel used to build their signatures. The refresh cooldown resets when a channel becomes ready, so a second rotation is not delayed by an earlier outage. The change includes rotation and recovery tests, a configuration example, and feature documentation.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defect established in the changed paths.

Summary

• Introduces retained endpoint resolvers, endpoint-equivalence validation, refresh cooldown and lifecycle coordination.
• Binds deferred session-request construction to the channel used to send the request and adds bounded channel waits.
• Preserves retained-session certificate inputs while allowing subsequent channels and newly created sessions to use the replacement certificate.
• Adds certificate-rotation, refresh, reverse-transport, request-failure, and channel-readiness coverage plus client documentation and configuration examples.

Diagram

sequenceDiagram
    participant Session as Session FSM
    participant Client as OpcUaClient
    participant Refresh as EndpointRefresh
    participant Resolver as EndpointResolver
    participant Transport as Client Transport
    participant Server as OPC UA Server

    Session->>Transport: Reconnect using cached endpoint certificate
    Transport->>Server: Establish SecureChannel
    Server-->>Transport: Handshake failure for stale certificate
    Transport-->>Refresh: onConnectFailure(failure)
    Refresh->>Resolver: resolve()
    Resolver->>Server: GetEndpoints
    Server-->>Resolver: Endpoints with replacement certificate
    Resolver-->>Refresh: Equivalent endpoint configuration
    Refresh->>Refresh: Publish refreshed endpoint
    Session->>Transport: Retry channel establishment
    Transport->>Server: Establish SecureChannel with replacement binding
    Server-->>Transport: Channel ready
    Transport-->>Refresh: onConnected()
    Refresh->>Refresh: Reset cooldown
    Session->>Transport: Build and send reactivation request on ready channel
    Server-->>Session: Reactivated session

Loading