OPC UA + gateway hardening (security, reconnect replay, multi-alarm, secure profile)

[mfaferek93]

Closes #477 #478 #479 #480

• OPC UA client security: SecurityPolicy / MessageSecurityMode / client application-instance cert / server trust store / user identity (anonymous, username-password, X.509). Anonymous + None stay the default.
• Active-condition replay on reconnect with a configurable strategy; read-based fallback for servers that reject ConditionRefresh (does not false-clear on a failed scan).
• Multi-alarm mapping by condition identity (ConditionName / SourceNode / EventType) + associated values.
• Opt-in secure config profile (auth/TLS/CORS/rate-limit) for field deployments; fails closed when enabled with invalid config.

Tested: 196 unit tests pass. Real-PLC acceptance for the security/replay/alarm paths is pending hardware validation.

[Copilot]

Pull request overview

This PR hardens both the southbound OPC UA plugin and the northbound gateway by adding OPC UA SecureChannel/user-auth configuration, improving alarm handling across reconnects (including read-based replay), supporting multi-alarm routing per condition identity, and shipping an opt-in “secure field profile” for gateway deployments that fails closed on invalid auth/TLS config.

Changes:

• Add OPC UA client security configuration (SecurityPolicy/MessageSecurityMode, certs/trust store, user identity) plus logging of the effective security profile.
• Implement active-condition replay on (re)subscribe with a configurable strategy and read-based fallback, including reconciliation logic to avoid false clears on scan failures.
• Add a secure gateway parameter preset + hardening documentation, and make gateway startup fail closed when TLS/auth is enabled but misconfigured.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp	Adds unit tests for replay-strategy parsing and reconcile false-clear guard.
src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_client.cpp	Adds unit tests for disconnected read-replay behavior and security parsing helpers.
src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_node_map.cpp	Adds unit tests for multi-alarm mapping resolution and associated-values parsing.
src/ros2_medkit_plugins/ros2_medkit_opcua/src/opcua_poller.cpp	Adds per-source event select specs, multi-alarm routing, and reconnect replay (ConditionRefresh + read fallback) with reconcile logic.
src/ros2_medkit_plugins/ros2_medkit_opcua/src/opcua_plugin.cpp	Parses new security + replay settings; logs effective security profile; uses resolved severity override from deliveries.
src/ros2_medkit_plugins/ros2_medkit_opcua/src/opcua_client.cpp	Implements security config application (certs/trust, user identity) and read-based condition scanning.
src/ros2_medkit_plugins/ros2_medkit_opcua/src/node_map.cpp	Makes nodes: optional, adds multi-alarm mappings + associated values, expands collision checks and lookup behavior.
src/ros2_medkit_plugins/ros2_medkit_opcua/README.md	Documents multi-alarm mappings, associated values, security config, and replay strategies.
src/ros2_medkit_plugins/ros2_medkit_opcua/include/ros2_medkit_opcua/opcua_poller.hpp	Declares replay strategy, reconcile helpers, and expanded delivery/runtime metadata.
src/ros2_medkit_plugins/ros2_medkit_opcua/include/ros2_medkit_opcua/opcua_plugin.hpp	Declares security-profile logging helper.
src/ros2_medkit_plugins/ros2_medkit_opcua/include/ros2_medkit_opcua/opcua_client.hpp	Adds security enums/config fields and read-based condition snapshot API.
src/ros2_medkit_plugins/ros2_medkit_opcua/include/ros2_medkit_opcua/node_map.hpp	Adds mapping/associated-value config types and alarm resolution API.
src/ros2_medkit_plugins/ros2_medkit_opcua/docker/gateway_params.yaml	Clarifies demo config is insecure and points to secure profile for deployments.
src/ros2_medkit_plugins/ros2_medkit_opcua/docker/Dockerfile.gateway	Ships the gateway secure params profile into the container image.
src/ros2_medkit_plugins/ros2_medkit_opcua/CMakeLists.txt	Forces open62541 encryption backend (OpenSSL) to support secured OPC UA profiles.
src/ros2_medkit_gateway/test/test_gateway_node.cpp	Adds tests asserting fail-closed behavior for invalid auth/TLS when enabled.
src/ros2_medkit_gateway/src/gateway_node.cpp	Changes TLS/auth builder failures to fatal + throw (fail closed) instead of silently disabling.
src/ros2_medkit_gateway/design/hardening.rst	Adds gateway hardening guide describing the secure field profile and deployment checklist.
src/ros2_medkit_gateway/config/gateway_params.secure.yaml	Adds hardened parameter preset enabling auth/TLS/restricted CORS/rate limiting/locking.

[bburda]

Additional findings outside the diff:

• ros2_medkit_opcua/package.xml has no test_depend/exec_depend on ros2_medkit_fault_manager, but the new test_opcua_secured.test.py launches fault_manager_node. The secured CI job passes only because it explicitly names --packages-up-to ... ros2_medkit_fault_manager; per the project's integration-test dependency rule, an isolated per-package build would not guarantee fault_manager is built first and the required secured gate would fail. Add <test_depend>ros2_medkit_fault_manager</test_depend>.

• The C event trampoline on_event_trampoline_c (opcua_client.cpp) calls the user callback with no try/catch, and run_iterate catches only opcua::BadStatus. This PR adds new throwing work reachable from that callback (resolve_alarm, associated-value string concatenation in on_event, conditions_.emplace), so a std::bad_alloc or any non-BadStatus exception unwinds through open62541's C frames - undefined behavior. Wrap the callback dispatch in try { ... } catch (...) { /* log, swallow */ }.