docs(reviews): close Driver.Sql-009 + Driver.Sql.Browser-001/002/003

-003 is a documented Won't Fix: the mitigating control is the ConfigEditor page
policy on the only two surfaces that reach a browse session (/raw and /uns),
there is no HTTP endpoint for browse, and PageAuthorizationGuardTests pins both
pages to that exact policy. Recorded in docs/security.md under Control-Plane
Authorization and pointed at from SqlDriverBrowser's class summary.

docs/security.md

@@ -719,6 +719,38 @@ Every routable AdminUI page carries an explicit **named-policy** `@attribute [Au
 
 In v2 the authentication + authorization stack is wired centrally by `AddOtOpcUaAuth` (`src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs`), which also installs a `FallbackPolicy` that requires an authenticated user. Razor pages gate inline with the named-policy attribute above, e.g. `@attribute [Authorize(Policy = AdminUiPolicies.ConfigEditor)]`. Nav-menu sections hide via `<AuthorizeView>`.
 
+#### Address-picker browse is an outbound-connect capability (trust boundary)
+
+Worth stating plainly, because "browse a configured database" reads weaker than what it is: the AdminUI's
+live address pickers **dial a target named in the browse form, from the AdminUI host, before anything is
+persisted.** The `Sql` picker is the sharpest case — `SqlDriverBrowser.OpenAsync`
+(`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/SqlDriverBrowser.cs`) accepts an **ad-hoc
+`connectionString` literal** an operator pastes for a database that has no `connectionStringRef` yet, and
+hands it to the ADO.NET provider verbatim. That is an arbitrary host and port plus whatever the provider's
+keyword set allows (`Microsoft.Data.SqlClient` alone offers `AttachDbFilename`, `Failover Partner`,
+`Enlist`). The OPC UA client and MQTT pickers have the same shape against their own endpoint fields.
+
+**The control is the page policy, and it is admin-grade.** The only surfaces that reach a browse session
+are `/raw` and `/uns`, both `@attribute [Authorize(Policy = AdminUiPolicies.ConfigEditor)]` — satisfied by
+`Administrator` or `Designer` only. There is **no HTTP endpoint** for browse: `IBrowserSessionService` is a
+scoped service consumed from those pages' Blazor circuits, so it inherits the page's policy and the
+`FallbackPolicy` beneath it, and `PageAuthorizationGuardTests` fails the build if either page's attribute
+drifts. A `Viewer` cannot open a picker; `AdminUiPolicies.DriverOperator` gates only the *live-ops* actions
+inside one (Sparkplug rebirth), never the connect.
+
+Supporting hygiene, none of which is the control:
+
+- The pasted literal is **never persisted** — `SqlDriverConfigDto` has no such property, so the driver
+  factory would drop it; the picker composes a session-only document and the browser keeps no field.
+- A literal supplied alongside a `connectionStringRef` **logs a warning** naming the shadowed ref (never
+  any connection text), so the override is visible rather than silent.
+- Every failure on the open path is **redacted** (`SqlDriverBrowser.Sanitize`), and the provider's own
+  connection-string-parser message is withheld outright because it quotes connection-string text verbatim.
+- `NodeEdit.razor` warns against pasting a literal into a *saved* `DriverConfig`, which would persist it.
+
+If a deployment needs the browse surface narrower than "anyone who may author config", the lever is the
+page policy (and the LDAP group→role mapping behind it), not the browser.
+
 ### Role grant source
 
 Admin reads `LdapGroupRoleMapping` rows from the Config DB (`src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Entities/LdapGroupRoleMapping.cs`) — the same pattern as the data-plane `NodeAcl` but scoped to Admin roles + (optionally) one cluster for multi-site fleets (a system-wide row, `IsSystemWide = true`, stacks additively with cluster-scoped rows). The `RoleGrants.razor` page lets `Administrator`s edit these mappings without leaving the UI.