docs: one role authority — precedence, normalization, and the overlay invariant (R3-04)

docs/Redundancy.md

@@ -208,7 +208,9 @@ The admin singleton is the cluster's only `RedundancyStateActor`. If the admin l
 
 ## Configuration
 
-Per-node identity comes from `appsettings.json` + the `OTOPCUA_ROLES` env var:
+Per-node identity comes from `appsettings.json` + one role source — `Cluster:Roles` (below) or the
+`OTOPCUA_ROLES` env var; either works, and if BOTH are set on a node they must agree (see
+[`Configuration.md`](Configuration.md) → `EffectiveRoles`, archreview R3-04):
 
 ```jsonc
 {
@@ -227,6 +229,9 @@ Per-node identity comes from `appsettings.json` + the `OTOPCUA_ROLES` env var:
 }
 ```
 
+the `Cluster__Roles__0`/`Cluster__Roles__1` env-var equivalent, or (the fallback, only when
+`Cluster:Roles` is absent/empty):
+
 ```
 OTOPCUA_ROLES=admin,driver
 ```