fix(arrays): Modbus row honours the FC16/FC03 protocol ceilings, the RMW read cap and the address-space end

Review r0 of Integration-W3:
- I1: the effective FC16 cap is min(configured maxRegistersPerWrite, 123). The
  driver trusts a larger configured cap and sends an over-ceiling FC16 (past 127
  registers its byte-count byte wraps), which every conformant device refuses, so
  such an array is never advertised writable.
- I2: a BitInRegister[] write reads its span first in one unchunked FC03, so it is
  also bounded by min(configured maxRegistersPerRead, 125) (absent/0 = 125).
- m2: every span (registers and coils) must end at or before address 65535.
- m1: the String-node wording says it converts only when the text parses, which
  the server cannot promise (DateTime never converts).
- m4: the parity device now enforces FC01/02 2000, FC03/04 125 (or a smaller
  device read limit), FC15 1968, FC16 123, FC23 121/125, the FC15/FC16 byte-count
  field (exception 03) and the address-space end (exception 02).

Tests: parity rows for each ceiling/cap/span boundary against the real write
path, and Core.Abstractions row tests. The configured-cap test that asserted a
cap of 200 lifts the ceiling now asserts the opposite.

Refs #741

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

docs/drivers/Modbus.md

@@ -141,7 +141,9 @@ bring-up required; the sim is always-on on the shared Docker host).
 **Array writes** (#610, #741) — a whole-array write goes out as one FC15 (coils) or one FC16
 (holding registers: numeric, `String` at `(stringLength+1)/2` registers per element, and
 `BitInRegister` as one FC03 + one FC16 read-modify-write of the span); the driver refuses rather than
-splits an FC16 longer than `maxRegistersPerWrite` (default 123). The server mirrors that: an array tag
+splits an FC16 longer than `maxRegistersPerWrite` (default 123; a larger value never lifts FC16's
+protocol ceiling of 123, and a BitInRegister array's unchunked FC03 also bounds it by
+`maxRegistersPerRead`). The server mirrors that: an array tag
 is client-writable only when it is addressed by `region` + `address` keys and
 `arrayLength × registers-per-element` fits the cap (and a coil array ≤ 1968), else its node stays
 read-only. A string-only (`addressString`) array stays read-only, because the composer cannot resolve