Auto: focas-f4a — write infrastructure + per-tag opt-in

Closes #268

docs/Driver.FOCAS.Cli.md

@@ -120,6 +120,25 @@ parameter-write switch enabled.
 **Writes are non-idempotent by default** — a timeout after the CNC already
 applied the write will NOT auto-retry (plan decisions #44 + #45).
 
+#### Server-side `Writes.Enabled` enforcement (issue #268, plan PR F4-a)
+
+The OtOpcUa server gates every FOCAS write behind two independent opt-ins:
+`FocasDriverOptions.Writes.Enabled` (driver-level master switch, default
+`false`) and `FocasTagDefinition.Writable` (per-tag, default `false`). When
+either is off, the server-side `WriteAsync` short-circuits to
+`BadNotWritable` before the wire client is touched. See
+[`docs/drivers/FOCAS.md`](drivers/FOCAS.md) "Writes (opt-in, off by
+default)" subsection + [`docs/v2/decisions.md`](v2/decisions.md) for the
+decision record.
+
+**The CLI bypasses the server-side flag.** `otopcua-focas-cli write` is a
+per-invocation operator tool — it sets `Writes.Enabled = true` locally for
+the lifetime of one process and creates the synthesised tag with
+`Writable = true`. This is intentional: the CLI is the operator's
+direct-to-CNC fallback, not a long-lived process bound to the central
+config DB. Configuring the server still requires both opt-ins to be set
+explicitly in the DriverInstance JSON.
+
 ### `subscribe` — watch an address until Ctrl+C
 
 FOCAS has no push model; the shared `PollGroupEngine` handles the tick