test(host): the R3-01 falsifiability control asserts the cookie-challenge signature (a bare Exception was satisfiable by an anonymised endpoint too); docs wording

docs/security.md

@@ -890,7 +890,7 @@ The fifth, `MapZbLocalDbSync()`, returns `IEndpointRouteBuilder` rather than an
 `app.MapGroup(string.Empty).AllowAnonymous().MapZbLocalDbSync()`, which carries the convention without
 changing the wire route pattern.
 
-**Two standing guards**, both in `tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/`, so a future map
+**Three standing guards**, all in `tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/`, so a future map
 cannot silently reopen this:
 
 - `MeshGrpcAnonymousMetadataTests` — an endpoint-metadata census that calls the SAME
@@ -899,7 +899,7 @@ cannot silently reopen this:
   and a scope check that the opt-out never leaks onto an unrelated endpoint.
 - `MeshGrpcMapConventionTests` — a `Program.cs` source scan asserting zero direct `MapGrpcService</
   MapZbLocalDbSync(` occurrences and exactly one call to the mapper, so a map added straight into
-  `Program.cs` (bypassing the helper, and therefore invisible to the census) fails the build.
+  `Program.cs` (bypassing the helper, and therefore invisible to the census) fails `MeshGrpcMapConventionTests`.
 - `MeshGrpcAuthStackTests` / `MeshGrpcDriverOnlyPipelineTests` drive the mesh endpoints through the REAL
   `AddOtOpcUaAuth` + `UseAuthentication`/`UseAuthorization` pipeline (`DisableLogin=false`) and the
   driver-only (no-auth-at-all) shape respectively — the CI-shaped reproduction of the outage, with a

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/MeshGrpcAuthStackTests.cs

@@ -252,8 +252,14 @@ public sealed class MeshGrpcAuthStackTests : IAsyncLifetime
         using var call = client.Sync(headers, cancellationToken: TestContext.Current.CancellationToken);
         await call.RequestStream.CompleteAsync();
 
-        await Should.ThrowAsync<Exception>(
+        // Review (R3-01): asserting a bare Exception was vacuous — an anonymised endpoint ALSO throws
+        // here (handler deps are not wired in this fixture => RpcException Unknown). Only the
+        // cookie-challenge signature discriminates: the FallbackPolicy's 302 to /login is a
+        // non-gRPC response, surfaced by grpc-dotnet as Internal + PROTOCOL_ERROR.
+        var ex = await Should.ThrowAsync<RpcException>(
             () => call.ResponseStream.MoveNext(TestContext.Current.CancellationToken));
+        ex.StatusCode.ShouldBe(StatusCode.Internal);
+        ex.Status.Detail.ShouldContain("PROTOCOL_ERROR");
     }
 
     // ---------------------------------------------------------------------------------------