fix(dashboard): bounded alarm drains, feed resubscribe, live pill, drop dead hub factory; doc corrections

docs/GatewayConfiguration.md

@@ -215,24 +215,28 @@ Three authorization policies are registered out of these options:
 
 ### SignalR hubs
 
-When the dashboard is enabled, three hubs are mapped under `/hubs/*`:
+When the dashboard is enabled, three hubs are mapped under `/hubs/*`. They are
+the **remote** surface — for clients outside the gateway process. Server-rendered
+pages do not use them: a page runs in this process and reads the producing
+services through in-process seams (`IDashboardSnapshotFeed`,
+`IDashboardSessionEventSubscriber`, `IGatewayAlarmService`) rather than opening a
+loopback WebSocket back into its own heap.
 
 - `GET /hubs/snapshot` — pushes `DashboardSnapshot` whenever the snapshot
-  service produces a new one. Drives every page that inherits
-  `DashboardPageBase`; replaces the earlier polling loop.
+  service produces a new one. Idle-gated on connected clients, so it stays
+  dormant unless a remote client connects.
 - `GET /hubs/alarms` — re-broadcasts the `AlarmFeedMessage` stream from the
   central alarm monitor to all connected clients (group `__alarms__`).
 - `GET /hubs/events` — per-session MxEvent feed. Clients call
   `SubscribeSession(sessionId)` to join `session:{id}`. Events are mirrored
-  from the corresponding gRPC `StreamEvents` call as a fire-and-forget
-  side-effect; the dashboard only sees events while a gRPC client is also
-  subscribed to that session.
+  from the session's own event distributor, gated on `EventsHubViewerRegistry`
+  so an unwatched session pays nothing.
 
 `GET /hubs/token` (cookie-only) mints a 5-minute data-protected bearer
-token for the calling user; the Blazor pages use it via
-`DashboardHubConnectionFactory` to authenticate the SignalR connection.
-The factory refreshes the token on every (re)connect, so the short lifetime
-(SEC-05) is transparent to clients. The token is not server-side revocable;
+token for the calling user, so a remote hub client can authenticate the
+SignalR connection without forwarding the HttpOnly dashboard cookie. Such a
+client is expected to re-fetch on every (re)connect, which makes the short
+lifetime (SEC-05) transparent. The token is not server-side revocable;
 its short lifetime bounds exposure of a captured token (see
 [GatewayDashboardDesign](./GatewayDashboardDesign.md)).