docs(mesh): ConfigSource/ConfigServe config, rig flip switch, Phase 3 as shipped

Phase 3 Task 9. docker-dev rig: central-1/2 carry ConfigServe (:4055 h2c + committed
dev key) and stay Direct; the four site nodes carry ConfigSource (both central
endpoints + matching key) defaulting to Direct. Flip only the site nodes with
OTOPCUA_CONFIG_MODE=FetchAndCache at 'docker compose up' — central keeps SQL and models
the target topology. Binding :4055 activates the dedicated-h2c Kestrel takeover on
central (re-binds :9000 too). Docs: new docs/Configuration.md ConfigSource/ConfigServe
section; docs/Redundancy.md 'config bytes travel out-of-band' note; the program plan
Phase 3 section + tracking row flipped to CODE-COMPLETE; a CLAUDE.md 'Config source'
section.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/Redundancy.md

@@ -438,6 +438,19 @@ are untouched, and `redundancy-state` itself stays on DPS (it is bidirectional a
 `Cluster.State`, which makes it genuinely mesh-bound — the hardest remaining dependency before the
 meshes can split).
 
+**Config bytes travel out-of-band (Phase 3).** Commands stay on one of the two transports above, but
+the *configuration artifact itself* does not ride any Akka message — `DispatchDeployment` is
+payload-free (`DeploymentId` + `RevisionHash`). Under `ConfigSource:Mode = FetchAndCache` (see
+[Configuration.md § `ConfigSource`](Configuration.md#configsource--configserve-config-fetch-and-cache))
+a driver node fetches the bytes from central over a dedicated h2c **gRPC stream**, verifies
+`SHA-256 == RevisionHash`, and reads only its LocalDb cache — no central-SQL config read. **Both pair
+nodes fetch independently**, exactly as both read SQL today: there is no Primary gating of the fetch.
+That is safe because `StoreAsync` is idempotent and the cache replicates (pair replication carries the
+artifact to a node that missed its own fetch), and it keeps config delivery decoupled from redundancy
+timing. Central serves the bytes from its SQL row; a `FetchAndCache` node that cannot reach central
+fails the apply and keeps last-known-good (it never tears down to an empty address space), and it boots
+its served state from the LocalDb pointer with no central dependency at all.
+
 ## Pair-local store (LocalDb — Phases 1 + 2)
 
 Independently of the ServiceLevel machinery above, every **driver-role** node keeps a consolidated