docs(audit): apply global term/path substitutions across living docs

docs/GatewayDashboardDesign.md

@@ -288,7 +288,7 @@ it opt-in and redacted.
 
 ### Browse page
 
-`/dashboard/browse` lets an operator explore the Galaxy tag hierarchy and watch
+`/browse` lets an operator explore the Galaxy tag hierarchy and watch
 live values. The tree is built in-process by `DashboardBrowseTreeBuilder` from
 `IGalaxyHierarchyCache.Current` — the same cache the Galaxy page reads — so a
 render costs no gRPC call and no SQL round-trip. Each node shows its child
@@ -306,7 +306,7 @@ diagnostic session/worker views.
 
 ### Alarms page
 
-`/dashboard/alarms` lists the alarms the gateway's central alarm monitor
+`/alarms` lists the alarms the gateway's central alarm monitor
 currently holds as Active or ActiveAcked, refreshed every three seconds. It
 defaults to showing unacknowledged `Active` alarms; filters add acknowledged
 alarms and narrow by area, severity range, and a reference/source/description
@@ -335,7 +335,7 @@ the monitor never starts and the cache stays empty.
 
 ### API keys page
 
-`/dashboard/apikeys` lists the gateway's API keys and, for authorized
+`/apikeys` lists the gateway's API keys and, for authorized
 operators, manages them. It reads key metadata through the same
 `IApiKeyAdminStore` the `apikey` CLI uses, so the dashboard and the CLI act
 on one source of truth.
@@ -421,7 +421,7 @@ Implemented behavior:
   `ClaimTypes.Role` claims, alongside the per-group `mxgateway:ldap_group`
   claims;
 - a successful login signs in the `MxGateway.Dashboard` cookie scheme
-  (`__Host-MxGatewayDashboard`, HttpOnly, SameSite=Strict, Secure);
+  (`MxGatewayDashboard`, HttpOnly, SameSite=Strict, Secure);
 - a user with no matching group cannot sign in — the login screen returns the
   generic credential-rejected message;
 - antiforgery tokens guard the login and logout POSTs.