docs+test(closeout): final-review reservations — stale ACL prose, worker test gaps, config sample fix

docs/Authorization.md

@@ -198,10 +198,19 @@ Tags are set at key creation with
 trimmed and de-duplicated ordinal-ignore-case). Keys created from the dashboard
 API Keys page are currently always untagged.
 
-The tag is carried end to end today; the dashboard ACL that consumes it — scoping
-a Viewer's `EventsHub` subscriptions to the sessions their LDAP groups are
-granted — is a separate change. Until it lands, the tag affects nothing at
-runtime.
+The dashboard ACL that consumes the tag shipped on 2026-08-17 (SEC-25 / TST-15).
+`IDashboardSessionAcl.CanViewSession` is consulted at both dashboard subscribe
+seams — the SignalR `EventsHub.SubscribeSession` join and the in-process
+`IDashboardSessionEventSubscriber.Subscribe` behind the session-details page — so
+per-session event visibility is enforced at runtime: a Viewer observes a session
+only when the session's tags intersect the tags their LDAP groups are granted
+through `MxGateway:Dashboard:GroupToTag`. Administrators bypass the intersection,
+and a session with no tags is visible to Administrators only unless
+`MxGateway:Dashboard:UntaggedSessionVisibility` is set to `AllViewers`.
+
+That enforcement is still *visibility*, not data access. The ACL decides which
+sessions' mirrored events a dashboard principal may observe; it does not widen or
+narrow what any API key may read, write, browse, or subscribe to over gRPC.
 
 Glob matching is anchored, case-insensitive, and supports `*` and `?`.
 Subtree and tag glob lists are alternatives: matching either list allows that