docs: reconcile stale cluster/security/notification docs; close register row 117, add rows 128-135 (review 2026-10-21 wave 2)

docs/requirements/Component-ClusterInfrastructure.md

@@ -29,7 +29,7 @@ realised across two projects:
   timings, split-brain settings) bound from `appsettings.json` via the Options pattern.
 - **`src/ZB.MOM.WW.ScadaBridge.Host`** owns the cluster **bootstrap and runtime wiring**: it
   builds the Akka.NET HOCON from `ClusterOptions`, starts the `ActorSystem`,
-  configures the keep-oldest split-brain resolver (`down-if-alone = on`), wires
+  configures the downing strategy (`auto-down` by default; `keep-oldest` with `down-if-alone` is the opt-in alternative), wires
   `CoordinatedShutdown` into the service lifecycle, and provides active-node /
   cluster-membership health checks. See `Component-Host.md` (REQ-HOST-*) for detail.
 
@@ -220,7 +220,7 @@ If both nodes in a cluster fail simultaneously (e.g., site power outage):
 2. **State recovery** (each node has its own local copy of all required data):
    - **Site clusters**: The Deployment Manager singleton reads deployed configurations from local SQLite and re-creates the full Instance Actor hierarchy. Store-and-forward buffers are already persisted locally. Alarm states re-evaluate from incoming data values.
    - **Central cluster**: All state is in MS SQL (configuration database). The active node resumes normal operation.
-3. The keep-oldest resolver handles the "both starting fresh" case naturally — there is no pre-existing cluster to conflict with.
+3. Cold start does not involve the downing strategy: nothing is unreachable yet, so there is no pre-existing cluster to conflict with (the simultaneous-start residual is covered by the bootstrap guard above).
 
 ## Graceful Shutdown & Singleton Handover
 

docs/requirements/Component-Host.md

@@ -58,7 +58,7 @@ The Host must bind configuration sections from `appsettings.json` to strongly-ty
 | `ScadaBridge:HealthMonitoring` | `HealthMonitoringOptions` | Health Monitoring | ReportInterval, OfflineTimeout |
 | `ScadaBridge:SiteEventLog` | `SiteEventLogOptions` | Site Event Logging | RetentionDays, MaxStorageMb, PurgeScheduleCron |
 | `ScadaBridge:Communication` | `CommunicationOptions` | Communication | DeploymentTimeout, LifecycleTimeout, QueryTimeout, TransportHeartbeatInterval, TransportFailureThreshold |
-| `ScadaBridge:Security` | `SecurityOptions` | Security & Auth | LdapServer, LdapPort, LdapUseTls, JwtSigningKey, JwtExpiryMinutes, IdleTimeoutMinutes |
+| `ScadaBridge:Security` | `SecurityOptions` | Security & Auth | LdapServer, LdapPort, LdapUseTls, JwtSigningKey (HS256 key for the CLI/API bearer token from `/auth/token`; >= 32 bytes, validated on Central), JwtExpiryMinutes (bearer lifetime), IdleTimeoutMinutes (cookie idle window), RoleRefreshThresholdMinutes, RoleMappingCacheSeconds |
 | `ScadaBridge:InboundApi` | `InboundApiOptions` | Inbound API | DefaultMethodTimeout, MaxRequestBodyBytes, ApiMethodCacheTtl, StandbyForwardPeerEndpoints (HTTP base URLs of the other central node — a standby relays `POST /api/*` there instead of answering 503), StandbyForwardTimeout |
 | `ScadaBridge:Notification` | `NotificationOptions` | Notification Service | (SMTP config is stored in the central config DB, not in appsettings) |
 | `ScadaBridge:NotificationOutbox` | `NotificationOutboxOptions` | Notification Outbox | Dispatcher poll interval, stuck-age threshold, retention window (delivery retry settings reuse the central SMTP configuration) |

docs/requirements/HighLevelReqs.md

@@ -437,7 +437,7 @@ Audit logging is implemented as part of the **Configuration Database** component
 
 ### 10.1 Storage
 - Audit logs are stored in the **configuration MS SQL database** alongside system config data, enabling direct querying.
-- Entries are **append-only** — never modified or deleted. No retention policy — retained indefinitely.
+- Entries are **append-only** — never modified or deleted. Retained indefinitely by default; an optional `ScadaBridge:ConfigAudit:RetentionDays` (default `0` = off) enables a daily batched purge of older entries.
 
 ### 10.2 Scope
 All system-modifying actions are logged, including: