SIENTIAPDE-1974: feat(read): keep the legacy OpcManager as plan B (READ_ENGINE)

The rc3 OpcManager is restored unchanged (with its tests and
scripts/generate-and-push-opc-cert.sh) for validation and as a fallback until
the end of SIENTIAPDE-1974; it is removed only once it is unused and the test
suite passes the same without it.

- READ_ENGINE=v2 (default): ServerReader/SubscriptionEngine over the shared
  pool, certificate from MinIO. READ_ENGINE=legacy: the rc3 OpcManager with
  its own connection, slot v1 only (a v2 slot is rejected and notified) and
  the certificate files of the Gitea clone. An invalid value falls back to v2
  with a warning. Writes/gRPC always use the pool.
- pool: OPC clients carry the pod id as application/session name and product
  URI (as OpcManager did), so each pod's session is recognizable in the
  server console; application_uri stays the server_uri (certificate SAN).
- README/CLAUDE.md document the plan B and how to remove it.

Tests: 275 unit tests pass (restored OpcManager tests unchanged); ruff clean.
Local e2e: both engines read the same slot v1 from an asyncua server and write
identical documents to the same collections.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestor/connection/pool.py

@@ -105,8 +105,17 @@ class OpcConnectionPool(SientiaMonitoring):
 
     async def _connect(self, server_cfg: dict) -> Client:
         client = Client(server_cfg['url'], timeout=10)
+        # Identify the pod on the OPC server, as the legacy OpcManager did: asyncua
+        # sends `name` as ApplicationName and "<description> Session<n>" as the
+        # session name, so each pod's session is recognizable in the server console.
+        client.name = self.pod_id
+        client.description = self.pod_id
+        pod_uri = self.pod_id.replace('-', ':')
+        client.product_uri = pod_uri
+        client.application_uri = pod_uri
         server_uri = server_cfg.get('server_uri')
         if server_uri:
+            # Must match the certificate's SAN URI (KEPServer: BadCertificateUriInvalid).
             client.application_uri = server_uri
         if server_cfg.get('use_security'):
             cert, key = await self.cert_provider.fetch()