SIENTIAPDE-1973

SIENTIAPDE-1973: Implement per-connector OPC client certificates and remove legacy read engine.
This update overhauls certificate management, transitioning from a single platform certificate to individual client certificates defined in the slot configuration. The CertProvider now downloads certificates from MinIO based on certificate_id, applying dynamic security policies (mode, policy) from the slot. The legacy READ_ENGINE=legacy option and OpcManager have been entirely removed, standardizing on the ServerReader with strict slot v2 enforcement. Write command resolution (ServerConfigResolver) now consistently uses connectors joined with opc_certificates. The CERT_BUCKET environment variable is no longer used.

ingestor/engines/write.py

@@ -83,7 +83,7 @@ class WriteEngine(SientiaMonitoring):
         self.pool = pool
         self.sink = sink
         # Resolves the server connection by server_id (SIENTIAPDE-1975 GW1). Without it,
-        # only the connection carried by the command itself is used.
+        # no server is known and every write fails as server_not_found.
         self.servers = servers
         self.write_timestamp = write_timestamp
         self.write_quality = write_quality
@@ -146,18 +146,12 @@ class WriteEngine(SientiaMonitoring):
         self._last_write_at = now
 
     async def _server_cfg(self, cmd: dict) -> dict | None:
-        """Connection settings of the target server: resolved by server_id (connection
-        carried by the command, live pooled connection, connectors, opc-servers), or only
-        the ones carried by the command when no resolver is wired."""
-        if self.servers is not None:
-            return await self.servers.resolve(str(cmd['server_id']), cmd)
-        if not cmd.get('url'):
+        """Connection settings of the target server, resolved by server_id (live pooled
+        connection, then connectors → opc_certificates). The command carries only the
+        server_id (C2)."""
+        if self.servers is None:
             return None
-        return {
-            'url': cmd.get('url'),
-            'use_security': cmd.get('use_security', False),
-            'server_uri': cmd.get('server_uri'),
-        }
+        return await self.servers.resolve(str(cmd['server_id']))
 
     def _variant_type(self, data_type: str) -> ua.VariantType:
         # direct index: unknown dtypes already became ConversionError in to_typed_value