docs(auth): canonical scope strings in the two remaining stale lists

Both lists predate the scope rename and would mislead anyone creating a key:
CLAUDE.md's Authentication section still named the pre-rename scopes, and
docs/Authentication.md's ops.alice example passed 'read,write', which
GatewayScopes.ValidateScopes rejects outright. Same defect family as the
Build/Test/Run sample fixed in a5f843c.

Recorded as a follow-up: code review finding Server-012 claims it fixed the two
CLAUDE.md lists on 2026-05-18, but neither correction was present — a Resolved
finding is not re-examined, so the sibling Server-0xx doc resolutions want a
spot-check for the same pattern.

docs/plans/2026-08-17-followup-closeout.md

@@ -496,6 +496,15 @@ Follow-ups recorded, not started:
 - The ack-leg probe stays blocked; unblock paths are in `docs/AlarmProbeFindings.md`.
 - The dashboard `AlarmsPage` truncation banner is still poll-driven — it could consume
   the new `snapshot_status` feed frame instead.
+- **A closed code-review finding regressed, or was never applied.** Server-012
+  (`code-reviews/Server/findings.md:405-412`) is recorded *Resolved 2026-05-18* and claims
+  it corrected two scope lists to the canonical `*:*` strings — the `CLAUDE.md`
+  Build/Test/Run `apikey` sample and the `CLAUDE.md` Authentication-section scope list.
+  Neither correction was present when this branch looked; both were re-fixed here, along
+  with a third instance the finding never covered (`docs/Authentication.md`'s `ops.alice`
+  example). The bookkeeping is the follow-up: other `Server-0xx` entries marked Resolved
+  with documentation-only fixes should be spot-checked for the same pattern, since a
+  finding that reads Resolved is not otherwise re-examined.
 
 Explicitly decided, not an omission: **`../scadaproj/CLAUDE.md` needs no update.** The
 umbrella index records the *set* of `.proto` files this repo owns, and that set is