docs(claude): refresh CLAUDE.md + record historian-gateway integration/dev-rig state

CLAUDE.md: add scadaproj sister-project index, fix mxaccessgw path to
~/Desktop/MxAccessGateway, note the temporary CVE-2025-6965 NuGetAuditSuppress,
and correct the driver-typed tag-editor list (OpcUaClient is now mapped; only
Galaxy falls back). Also captures docker-dev data-plane GroupToRole + ServerHistorian
live-verify config and the HistorianGateway integration/backlog notes.

CLAUDE.md

@@ -17,6 +17,44 @@ service.
 See `docs/v2/Galaxy.Performance.md` for the runtime perf surface
 (tracing, metrics, soak harness).
 
+## Related Projects (scadaproj umbrella)
+
+This repo is one of a family of related SCADA / OT / Wonderware / OPC UA
+**sister projects** that live as sibling directories under `~/Desktop/`. They are
+**separate repos and separate processes**, coupled at runtime over wire protocols
+(gRPC + OPC UA) — not by project/compile references — and share the
+`ZB.MOM.WW.*` product namespace. The common subject is AVEVA System Platform
+(Wonderware) "Galaxy" data, and `mxaccessgw` is the linchpin the others connect
+through.
+
+- **`~/Desktop/scadaproj`** ([`../scadaproj/CLAUDE.md`](../scadaproj/CLAUDE.md)) —
+  the umbrella/index workspace that aggregates the whole family (a high-level scan
+  of each sister project: purpose, location, stack, primary commands). It also hosts
+  the shared `ZB.MOM.WW.*` libraries — `ZB.MOM.WW.Auth`, `ZB.MOM.WW.Theme`,
+  `ZB.MOM.WW.Health`, `ZB.MOM.WW.Telemetry`, `ZB.MOM.WW.Configuration`, and
+  `ZB.MOM.WW.GalaxyRepository`. **This repo is indexed there** — see the OtOpcUa
+  entry in `../scadaproj/CLAUDE.md`.
+- **`~/Desktop/MxAccessGateway`** (`mxaccessgw`,
+  [`../MxAccessGateway/CLAUDE.md`](../MxAccessGateway/CLAUDE.md)) — the gRPC gateway
+  that owns the MXAccess 32-bit COM bitness + STA pump (gateway x64 .NET 10 + per-session
+  x86 net48 worker). **OtOpcUa's `GalaxyDriver` depends on this** for live Galaxy
+  read/write/subscribe and Galaxy Repository browse.
+- **`~/Desktop/HistorianGateway`**
+  ([`../HistorianGateway/CLAUDE.md`](../HistorianGateway/CLAUDE.md)) — single-process
+  gRPC sidecar exposing the AVEVA Historian read/write API + read-only Galaxy browse
+  (via the shared `ZB.MOM.WW.GalaxyRepository` lib). Patterned on `mxaccessgw` but with
+  no COM / no x86 worker. **OtOpcUa's historian backend** (`Driver.Historian.Gateway`)
+  consumes it as the sole historian path.
+- **`~/Desktop/ScadaBridge`**
+  ([`../ScadaBridge/CLAUDE.md`](../ScadaBridge/CLAUDE.md)) — the distributed SCADA
+  platform (Akka.NET hub-and-spoke) whose Data Connection Layer consumes this server's
+  OPC UA address space.
+
+**Propagate cross-repo changes to the umbrella index.** When a fact the index records
+about OtOpcUa changes here — remote/push status, the driver set, the Galaxy data flow,
+shared-lib consumption, or per-project commands — update the **OtOpcUa entry in
+`../scadaproj/CLAUDE.md`** in the same change so the index never drifts from this repo.
+
 ## Architecture Overview
 
 ### Data Flow
@@ -61,7 +99,7 @@ Galaxy `mx_data_type` values map to OPC UA types (Boolean, Int32, Float, Double,
 
 ## mxaccessgw
 
-The gateway lives in a sibling repo at `c:\Users\dohertj2\Desktop\mxaccessgw\`. See `docs/v2/Galaxy.ParityRig.md` for the gw setup recipe (build, API key provisioning via `apikey create-key`, env-var overrides for HTTP/2 cleartext + worker path). The gw's MXAccess Toolkit reference (its `gateway.md`) is the canonical MxAccess API doc; the standalone `mxaccess_documentation.md` previously kept in this repo retired in PR 7.3.
+The gateway lives in a sibling repo at `~/Desktop/MxAccessGateway/` (`mxaccessgw` — see [Related Projects](#related-projects-scadaproj-umbrella)). See `docs/v2/Galaxy.ParityRig.md` for the gw setup recipe (build, API key provisioning via `apikey create-key`, env-var overrides for HTTP/2 cleartext + worker path). The gw's MXAccess Toolkit reference (its `gateway.md`) is the canonical MxAccess API doc; the standalone `mxaccess_documentation.md` previously kept in this repo retired in PR 7.3.
 
 ## Build Commands
 
@@ -73,6 +111,11 @@ dotnet test tests/Core/ZB.MOM.WW.OtOpcUa.Core.Tests               # a single tes
 dotnet test --filter "FullyQualifiedName~MyTestClass.MyMethod"    # a single test
 ```
 
+`Directory.Build.props` carries a temporary `NuGetAuditSuppress` for
+CVE-2025-6965 / GHSA-2m69-gcr7-jv3q (transitive native `SQLitePCLRaw.lib.e_sqlite3`,
+no upstream fix yet) — so restore/build not flagging it is expected; remove the
+suppression once a patched bundle ships.
+
 Test projects live under `tests/<module>/` (Core, Server, Drivers,
 Drivers/Cli, Client, Tooling) — there is no single unit-test project.
 Unit suites are named `*.Tests`; integration suites are `*.IntegrationTests`
@@ -165,7 +208,7 @@ Address pickers in AdminUI support live browse for OpcUaClient and Galaxy driver
 
 The AdminUI's global **UNS** page (`/uns`) is the single surface for managing the unified namespace fleet-wide (Area → Line → Equipment → Tag/VirtualTag), replacing the old per-cluster UNS/Equipment/Tags tabs. See `docs/Uns.md`.
 
-The `/uns` **TagModal** uses **driver-typed tag-config editors**: it dispatches by the bound driver's `DriverType` to a per-driver editor (Modbus/S7/AbCip/AbLegacy/TwinCAT/Focas) via `TagConfigEditorMap`, with client-side validation via `TagConfigValidator`; unmapped drivers (OpcUaClient/Galaxy) fall back to the generic raw-`TagConfig`-JSON textarea. Each editor is a thin razor shell over a pure `<Driver>TagConfigModel` (`FromJson`/`ToJson`/`Validate`, preserves unknown keys). To add a driver's editor, copy the Modbus template under `Components/Shared/Uns/TagEditors/` + `Uns/TagEditors/`, reusing the driver's enums + camelCase JSON property names, and register it in `TagConfigEditorMap` + `TagConfigValidator`. See `docs/plans/2026-06-09-driver-typed-tag-editors-design.md`.
+The `/uns` **TagModal** uses **driver-typed tag-config editors**: it dispatches by the bound driver's `DriverType` to a per-driver editor (Modbus/S7/AbCip/AbLegacy/TwinCAT/Focas/OpcUaClient) via `TagConfigEditorMap`, with client-side validation via `TagConfigValidator`; unmapped drivers (only Galaxy) fall back to the generic raw-`TagConfig`-JSON textarea. Each editor is a thin razor shell over a pure `<Driver>TagConfigModel` (`FromJson`/`ToJson`/`Validate`, preserves unknown keys). To add a driver's editor, copy the Modbus template under `Components/Shared/Uns/TagEditors/` + `Uns/TagEditors/`, reusing the driver's enums + camelCase JSON property names, and register it in `TagConfigEditorMap` + `TagConfigValidator`. See `docs/plans/2026-06-09-driver-typed-tag-editors-design.md`.
 
 ## Scripting / Script Editor