docs(reviews): re-verify doc-only Server-0xx resolutions; re-fix regressions

Audited every Server-0xx finding whose Resolution described a
documentation-only or comment-only change, and spot-checked the doc
sub-claims of otherwise test-backed resolutions. 20 entries annotated
in place (append-only; no historical resolution text rewritten).

Two corrections had not survived and are re-applied:

Server-040: the MapGroupsToRoles lookup-precedence comment moved intact
into DashboardGroupRoleMapping (792e3f9) and was then deleted wholesale
by fca978d, a sweep meant only to strip (Server-NNN) tracking markers.
That also removed a later, substantive paragraph recording that the
shared ZB.MOM.WW.Auth.Ldap provider pre-strips groups to short RDN
names, so a full-DN GroupToRole key is unsupported. Both paragraphs
restored, minus the tracking IDs.

Server-009: the WAL / busy_timeout note vanished when the Storage
section of docs/Authentication.md was rewritten to delegate
connection-factory detail to ZB.MOM.WW.Auth.ApiKeys. The behavior is
still live in the library (confirmed against 0.2.1), so the fix is
prose-only.

Server-011/014/022/023 are annotated as moot rather than regressed:
the IAlarmRpcDispatcher trio was deleted in dc9c0c9 and no stale
'not yet wired' / 'PR A.6/A.7' prose survives in Server source.
Server-038's documented v1 ACL gap was later closed by
IDashboardSessionAcl, so its remarks are current.

Comment/doc-only; no logic changes.

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardGroupRoleMapping.cs

@@ -31,6 +31,23 @@ internal static class DashboardGroupRoleMapping
         {
             string normalizedGroup = group.Trim();
 
+            // Lookup precedence: the full literal group string is tried first; only if
+            // that misses do we fall back to the leading RDN value (e.g. "GwAdmin"
+            // extracted from "ou=GwAdmin,ou=groups,..."). The map's comparer is
+            // OrdinalIgnoreCase (see DashboardOptions.GroupToRole), so "GwAdmin" and
+            // "gwadmin" both match.
+            //
+            // With the shared ZB.MOM.WW.Auth.Ldap provider, groups arrive here already
+            // stripped to short RDN names (the library calls FirstRdnValue before
+            // returning them). So through the live login path the full-string branch
+            // only ever sees short names and the RDN fallback is effectively a no-op —
+            // they collapse to the same key. The fallback is retained because this
+            // mapping is also reachable directly via the IGroupRoleMapper<string> seam
+            // (DashboardGroupRoleMapper), where a caller could still pass a full DN.
+            // CONSEQUENCE: configuring a full-DN GroupToRole *key* (e.g.
+            // "ou=GwAdmin,ou=groups,...") is UNSUPPORTED with the shared library — the
+            // incoming group is a short name, so it will never equal a full-DN key.
+            // Keep GroupToRole keys as short group names.
             if (groupToRole.TryGetValue(normalizedGroup, out string? mapped)
                 || groupToRole.TryGetValue(ExtractFirstRdnValue(normalizedGroup), out mapped))
             {