docs: point markdown backlogs at Gitea issues (status lives in Gitea)

docs/security.md

@@ -1,5 +1,8 @@
 # Security
 
+> **Status lives in Gitea.** Open follow-ups and known gaps noted in this doc are tracked as issues on
+> gitea.dohertylan.com/dohertj2/lmxopcua (label `migrated`, 2026-11-06). This doc describes the system — do not track status here; file new work as an issue.
+
 > **v2 status (2026-05-26).** The four security concerns below are unchanged in v2.
 > Paths + project names moved: `OtOpcUa.Server/Security/` → `OtOpcUa.Security/`
 > (`Ldap/`, `Jwt/`, `Endpoints/AuthEndpoints.cs`), `OtOpcUa.Admin` is gone (its
@@ -264,7 +267,7 @@ guards in front of the store, bound from the same `Security:ApiKeys` section
 
 The budget is **process-wide, not per remote endpoint**: the OPC UA SDK's impersonation callback (the
 `IOpcUaUserAuthenticator` seam) does not carry the client's address, so per-endpoint accounting needs that
-seam widened in the OpcUaServer project (a Wave 3 follow-up). Neither guard applies to a driver-only node:
+seam widened in the OpcUaServer project (a Wave 3 follow-up → #751). Neither guard applies to a driver-only node:
 its `ArtifactApiKeyStore` is two in-memory dictionary probes and is never wrapped.
 
 ### LDAP bind flow (`OtOpcUaLdapAuthService`)