docs(dashboard): GroupToRole/GroupToTag keys are short names — full-DN keys never match the pre-stripped groups

Follow-up to the Server-040 comment restoration (d3ac527). The restored
comment in DashboardGroupRoleMapping records that the shared
ZB.MOM.WW.Auth.Ldap provider hands the mapper groups already stripped to
short RDN names, so a full-DN GroupToRole *key* can never match. Three
doc sites still told operators the opposite, and the tag mapper carried
the same consequence with no comment at all.

- docs/GatewayConfiguration.md: GroupToRole and GroupToTag rows both said
  keys may be 'short CN or full DN — leading-RDN match'. Corrected to
  short group names only, with the reason (pre-stripped groups) and a
  note that the mapper's full-string-then-RDN fallback only matters to
  non-library callers of the IGroupRoleMapper<string> seam.
- docs/GatewayDashboardDesign.md: the login-flow bullet said the user's
  memberOf '(or short CN)' is matched against GroupToRole; it now
  describes what actually happens — groups arrive short and are matched
  against short-name keys.
- DashboardGroupTagMapping: short comment at the lookup pointing at the
  DashboardGroupRoleMapping comment, since it reuses ExtractFirstRdnValue
  and inherits the same full-DN-key-unsupported consequence.

Both doc rows are pre-existing on main — they predate this branch and
were not introduced by the Server-040 work; only their incorrectness was
surfaced by it. Comment/doc-only; no logic changes.

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardGroupTagMapping.cs

@@ -35,6 +35,13 @@ internal static class DashboardGroupTagMapping
         {
             string normalizedGroup = group.Trim();
 
+            // Same lookup semantics as DashboardGroupRoleMapping.MapGroupsToRoles —
+            // full literal group string first, leading-RDN value as the fallback, over
+            // an OrdinalIgnoreCase map. See the comment there for the consequence that
+            // applies verbatim here: the shared ZB.MOM.WW.Auth.Ldap provider delivers
+            // groups already stripped to short RDN names, so a full-DN GroupToTag *key*
+            // is UNSUPPORTED — it can never equal the short name that arrives. Keep
+            // GroupToTag keys as short group names.
             if (!groupToTag.TryGetValue(normalizedGroup, out string[]? granted)
                 && !groupToTag.TryGetValue(
                     DashboardGroupRoleMapping.ExtractFirstRdnValue(normalizedGroup),