docs+ui(security): state plainly that node ACLs are not enforced (§8.1, #520)

deferment.md §8.1 asked for a decision: wire IPermissionEvaluator into the node
manager, or say plainly that ACLs are not enforced. Decision: the latter. The
evaluator stays in the tree; #520 tracks the wire-up.

Verifying the claim turned up four things worse than the audit recorded:

- docs/security.md, not ReadWriteOperations.md, was the highest-risk doc. It
  claimed an anonymous session is "default-denie[d] any node a session has no
  ACL grant for". The opposite holds: anonymous can Browse/Read/Subscribe/
  HistoryRead the entire address space, and is refused writes and alarm acks
  only because it carries no roles.
- Three of five documented data-plane role strings do nothing.
  OpcUaDataPlaneRoles declares exactly WriteOperate and AlarmAck; ReadOnly,
  WriteTune and WriteConfigure are compared against nowhere in src/. The doc
  called all five "exact, case-insensitive, and code-true".
- ReadWriteOperations.md was fiction beyond the ACL claims. OnReadValue has
  zero occurrences in src/ — the documented read path did not exist. Reads
  never reach a driver: the node manager is push-model and the SDK serves a
  Read from the cached pushed value. WriteAuthzPolicy, _sourceByFullRef,
  _writeIdempotentByFullRef and IRoleBearer are likewise zero-hit, and
  CapabilityInvoker is not referenced by the OpcUaServer project at all. This
  file is rewritten rather than bannered.
- v2-release-readiness.md claimed a whole enforcement layer shipped —
  FilterBrowseReferences, GateCallMethodRequests, MapCallOperation,
  AuthorizationBootstrap, Node:Authorization:* keys. None exist. Whatever
  landed on the v2 branch did not survive into the shipped tree.

The UI change is the operative one: ClusterAcls.razor and AclEdit.razor now
warn that a grant is saved and shipped in every deployment artifact but never
evaluated, so an operator cannot author a deny rule believing it works.

deferment.md gains a §9 execution log tracking §8 remediation.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Clusters/AclEdit.razor

@@ -28,6 +28,19 @@ else if (!IsNew && _existing is null)
 }
 else
 {
+    <div class="alert alert-warning" role="alert">
+        <strong>This grant will not be enforced.</strong>
+        It is saved and shipped in every deployment artifact, but the OPC UA server never evaluates
+        ACL rows — the permission evaluator has no production call site. Nothing you set below will
+        change what a client can read, write, browse or acknowledge.
+        <br />
+        Real access control today is fleet-wide LDAP-group → role mapping
+        (<span class="mono">Security:Ldap:GroupToRole</span>):
+        <span class="mono">WriteOperate</span> to write any tag,
+        <span class="mono">AlarmAck</span> to acknowledge any alarm. Reads are ungated.
+        See <span class="mono">docs/security.md</span>.
+    </div>
+
     <EditForm Model="_form" OnValidSubmit="SubmitAsync" FormName="aclEdit">
         <DataAnnotationsValidator />
         <section class="panel rise" style="animation-delay:.02s">

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Clusters/ClusterAcls.razor

@@ -19,6 +19,19 @@
 }
 else
 {
+    <div class="alert alert-warning" role="alert">
+        <strong>These rules are not enforced.</strong>
+        ACL rows are saved and shipped in every deployment artifact, but the OPC UA server never
+        evaluates them — the permission evaluator has no production call site. Authoring a grant here
+        changes nothing about what a client can read or write.
+        <br />
+        What <em>is</em> enforced today is coarse and fleet-wide: a client needs the
+        <span class="mono">WriteOperate</span> role to write any tag and
+        <span class="mono">AlarmAck</span> to acknowledge any alarm, both mapped from LDAP groups via
+        <span class="mono">Security:Ldap:GroupToRole</span>. Reads, browses, subscriptions and history
+        reads are <strong>not</strong> restricted at all. See <span class="mono">docs/security.md</span>.
+    </div>
+
     <section class="panel notice rise" style="animation-delay:.02s">
         ACL rows grant LDAP groups specific <span class="mono">NodePermissions</span> on a scope
         (a folder, an equipment, a tag). Per-cluster role grants were dropped in favour of