docs: correct stale LDAP-role, host-probe, resilience-table, Bad-value claims; fix tasks.json (#624)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/Uns.md

@@ -391,7 +391,8 @@ See the individual driver docs under `docs/drivers/` for per-driver implementati
 
 An equipment tag is **writable by default** — the materialised OPC UA node is created
 `CurrentReadWrite` and inbound client writes are routed to the device (subject to the
-`WriteOperate` LDAP role gate). Setting the optional `"writable": false` key in a tag's
+`WriteOperate` gate — a role the session's API-key principal earns from its `NodeAcl` grants, see
+[security.md](security.md)). Setting the optional `"writable": false` key in a tag's
 `TagConfig` makes the node **read-only** at the driver seam. The six typed tag editors
 (Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS) expose this as a **Writable** checkbox
 (checked by default); it can also be hand-authored in the raw-JSON textarea.
@@ -405,7 +406,7 @@ An equipment tag is **writable by default** — the materialised OPC UA node is
 The key is honoured by Modbus, S7, AB CIP, AB Legacy, and TwinCAT. **FOCAS forces
 read-only regardless** — FOCAS PMC writes are unsupported in the wire client, so its
 editor shows the checkbox disabled/unchecked and any authored `writable:true` is ignored
-(and flagged at the deploy gate below). Node-level authz (LDAP `WriteOperate`) remains the
+(and flagged at the deploy gate below). Node-level authz (`WriteOperate` via the API-key principal's grants, not LDAP) remains the
 effective write gate above this flag.
 
 ## Deploy-time TagConfig validation (`Deployment:TagConfigValidationMode`)