review(OpcUaServer): record findings + fix stale node-manager/host docs

First review of the v2 OPC UA core at HEAD 7286d320. 6 findings (2 Medium, 4 Low).
OpcUaServer-006 fixed (stale NodeManager/ApplicationHost XML docs). 001-004 deferred
(cross-module: Runtime publish-actor / Core.Abstractions history contract / Wonderware
boundary semantics, or latent-only). 005 re-triaged Won't-Fix (coverage already exists).
High-scrutiny paths (Lock discipline, OnWriteValue fire-and-forget, WriteOperate/AlarmAck
gates, HistoryRead AccessLevel bits) verified correct.

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs

@@ -83,13 +83,12 @@ public sealed class OpcUaApplicationHostOptions
 
 /// <summary>
 /// Thin facade over the OPC Foundation .NET Standard SDK's application bootstrap.
-/// Owns the <see cref="ApplicationInstance"/> + <see cref="ApplicationConfiguration"/> lifetime
-/// and starts a <see cref="StandardServer"/> with the supplied node-manager factory.
-///
-/// Full extraction from legacy <c>OtOpcUa.Server</c> (security wiring, ScriptedAlarmDescriptor
-/// pipeline, ResilienceController, history backend, observability hooks) is tracked as
-/// follow-up F13. This facade compiles + boots the SDK so Task 53 can wire the fused Host's
-/// driver-role startup against it.
+/// Owns the <see cref="ApplicationInstance"/> + <see cref="ApplicationConfiguration"/> lifetime,
+/// builds the <see cref="ApplicationConfiguration"/> programmatically (security profiles + user
+/// token policies + PKI stores), starts a <see cref="StandardServer"/>, attaches the
+/// <c>ImpersonateUser</c> hook for UserName-token authentication via
+/// <see cref="IOpcUaUserAuthenticator"/>, and publishes the redundancy peer URIs through
+/// <c>Server.ServerArray</c>. See <c>docs/OpcUaServer.md</c> and <c>docs/security.md</c>.
 /// </summary>
 public sealed class OpcUaApplicationHost : IAsyncDisposable
 {
@@ -419,8 +418,11 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
     /// <summary>
     /// Anonymous + UserName token policies. UserName tokens are always SDK-encrypted with
     /// the server certificate (see docs/security.md "UserName token encryption") so the
-    /// policy works on None endpoints too. F13c will plug a real LDAP-bound validator into
-    /// <c>StandardServer.SessionManager.ImpersonateUser</c>.
+    /// policy works on None endpoints too. The real LDAP-bound validator is wired through
+    /// <see cref="IOpcUaUserAuthenticator"/> on <c>StandardServer.SessionManager.ImpersonateUser</c>
+    /// (see <see cref="AttachUserAuthenticator"/> / <see cref="HandleImpersonation"/>); the Host
+    /// project supplies the LDAP adapter, and <see cref="NullOpcUaUserAuthenticator"/> denies all
+    /// UserName logins when none is registered.
     /// </summary>
     internal static IEnumerable<UserTokenPolicy> BuildUserTokenPolicies()
     {