fix(dashboard): bounded alarm drains, feed resubscribe, live pill, drop dead hub factory; doc corrections

src/ZB.MOM.WW.MxGateway.Server/Dashboard/HubTokenService.cs

@@ -14,10 +14,12 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
 /// <remarks>
 /// This service is registered as a singleton in
 /// <see cref="DashboardServiceCollectionExtensions.AddGatewayDashboard"/> and
-/// is shared by two consumer scopes: <c>DashboardHubConnectionFactory</c>
-/// (scoped, per-circuit; calls <see cref="Issue"/> from the cookie-authenticated
-/// dashboard) and <c>HubTokenAuthenticationHandler</c> (transient, per-request;
-/// calls <see cref="Validate"/> from the SignalR negotiate / connection path).
+/// is shared by two consumer scopes: the <c>/hubs/token</c> endpoint (calls
+/// <see cref="Issue"/> for a cookie-authenticated caller) and
+/// <c>HubTokenAuthenticationHandler</c> (transient, per-request; calls
+/// <see cref="Validate"/> from the SignalR negotiate / connection path). Both
+/// serve external/remote hub consumers — server-rendered dashboard pages read the
+/// in-process feeds and never mint a hub token.
 /// The underlying <see cref="ITimeLimitedDataProtector"/> is thread-safe, so
 /// minting and validating concurrently from any number of callers is safe;
 /// future maintainers should preserve the singleton lifetime to keep the
@@ -31,9 +33,10 @@ public sealed class HubTokenService
     // revocable. A short lifetime bounds the exposure window of a token captured from a proxy
     // or log after logout (the cookie is cleared on logout, but outstanding tokens are not), and
     // bounds how long a stale role set survives a role change. Five minutes is transparent to
-    // clients because DashboardHubConnectionFactory mints a fresh token on every (re)connect;
-    // see docs/GatewayDashboardDesign.md. Heavier jti-denylist revocation is deliberately
-    // deferred until per-session hub ACLs land, when tokens gain session binding.
+    // clients that re-fetch from /hubs/token on every (re)connect, which is what a remote hub
+    // consumer is expected to do; see docs/GatewayDashboardDesign.md. Heavier jti-denylist
+    // revocation is deliberately deferred until per-session hub ACLs land, when tokens gain
+    // session binding.
     internal static readonly TimeSpan TokenLifetime = TimeSpan.FromMinutes(5);
 
     private readonly ITimeLimitedDataProtector _protector;