docs: clarify aggregate registration and SDK identity ownership

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs

@@ -161,8 +161,8 @@ public sealed class OpcUaQuotaOptions
 /// Thin facade over the OPC Foundation .NET Standard SDK's application bootstrap.
 /// Owns the <see cref="ApplicationInstance"/> + <see cref="ApplicationConfiguration"/> lifetime,
 /// builds the <see cref="ApplicationConfiguration"/> programmatically (security profiles + user
-/// token policies + PKI stores), starts a <see cref="StandardServer"/>, attaches the
-/// <c>ImpersonateUser</c> hook for UserName-token authentication via
+/// token policies + PKI stores), installs an SDK identity-registry authenticator before
+/// the <see cref="OtOpcUaSdkServer"/> opens its listeners via
 /// <see cref="IOpcUaUserAuthenticator"/>, and publishes the redundancy peer URIs through
 /// <c>Server.ServerArray</c>. See <c>docs/OpcUaServer.md</c> and <c>docs/security.md</c>.
 /// </summary>
@@ -468,7 +468,7 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
     private async Task EnsureApplicationCertificateAsync(CancellationToken cancellationToken)
     {
         // silent: false → SDK logs cert creation events through its own trace plumbing.
-        // minimumKeySize/lifetimeInMonths: 0 → use SDK defaults (2048-bit, 12-month lifetime).
+        // A null lifetime keeps the SDK default (12 months). Key-size policy comes from the configuration.
         var ok = await _application!.CheckApplicationInstanceCertificatesAsync(
             false, null, cancellationToken).ConfigureAwait(false);
         if (!ok)
@@ -610,10 +610,10 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
     /// <summary>
     /// Anonymous + UserName token policies. UserName tokens are always SDK-encrypted with
     /// the server certificate (see docs/security.md "UserName token encryption") so the
-    /// policy works on None endpoints too. The real LDAP-bound validator is wired through
-    /// <see cref="IOpcUaUserAuthenticator"/> on <c>StandardServer.SessionManager.ImpersonateUser</c>
-    /// (see <see cref="AttachUserAuthenticator"/> / <see cref="HandleImpersonation"/>); the Host
-    /// project supplies the LDAP adapter, and <see cref="NullOpcUaUserAuthenticator"/> denies all
+    /// policy works on None endpoints too. The Host supplies API-key authentication through
+    /// <see cref="IOpcUaUserAuthenticator"/>; <see cref="AttachUserAuthenticator"/> installs it in the
+    /// SDK identity registry before listeners open. <see cref="HandleImpersonation"/> retains the
+    /// application decision seam, and <see cref="NullOpcUaUserAuthenticator"/> denies all
     /// UserName logins when none is registered.
     /// </summary>
     /// <param name="allowAnonymous">Whether the Anonymous policy is advertised.</param>