docs: record Auth 0.1.5 consumer bumps + the pre-existing AngleSharp build break

Closes out the security-fix rollout: mxaccessgw, ScadaBridge and HistorianGateway
are all on Auth 0.1.5 and pushed. Exposure was checked per repo rather than assumed --
only mxaccessgw and ScadaBridge actually resolved the vulnerable 2.1.11;
HistorianGateway already resolved 3.50.3, and OtOpcUa takes no ApiKeys/SQLite
dependency at all.

Also records two things worth not rediscovering: HistorianGateway's bump is
unverified by tests, and both it and ScadaBridge have a pre-existing AngleSharp
NU1902 error failing full-solution builds under TreatWarningsAsErrors.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

README.md

@@ -64,7 +64,7 @@ Status verified 2026-07-18 against the feed + consumer branches (see [Roadmap](#
 
 | Component | Feed | Adoption | Folder |
 |---|---|---|---|
-| Auth (login / identity / authz) | `0.1.0`–`0.1.5` | all four (pins drift `0.1.1`–`0.1.4`; `0.1.5` = security fix, unconsumed) | [`components/auth/`](components/auth/) |
+| Auth (login / identity / authz) | `0.1.0`–`0.1.5` | mxaccessgw / ScadaBridge / HistorianGateway @ `0.1.5`; OtOpcUa @ `0.1.1` | [`components/auth/`](components/auth/) |
 | UI Theme (layout / tokens / components) | `0.2.0`–`0.3.1` | all four @ `0.3.1` | [`components/ui-theme/`](components/ui-theme/) |
 | Audit (event model + writer seam) | `0.1.0` | all four (DEEP) | [`components/audit/`](components/audit/) |
 | Config + validation | `0.1.0` | all four | [`components/configuration/`](components/configuration/) |
@@ -158,8 +158,9 @@ ZB_LDAP_IT=1 dotnet test   # requires a reachable GLAuth (e.g. a sister repo's i
 
 **Shipped**
 
-- ✅ Auth normalized + `ZB.MOM.WW.Auth` built (feed: `0.1.0`–`0.1.4`) and **adopted by all four apps**.
+- ✅ Auth normalized + `ZB.MOM.WW.Auth` built (feed: `0.1.0`–`0.1.5`) and **adopted by all four apps**.
-  Version pins drift on purpose: OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway + HistorianGateway `0.1.4`.
+  `0.1.5` (2026-07-18) pins patched SQLitePCLRaw; **mxaccessgw, ScadaBridge and HistorianGateway bumped to it**.
+  OtOpcUa stays at `0.1.1` — it takes no `ApiKeys`/SQLite dependency, so it was never exposed.
 - ✅ UI Theme normalized + `ZB.MOM.WW.Theme` built (feed: `0.2.0`–`0.3.1`); **all four apps on `0.3.1`**.
 - ✅ Audit — `ZB.MOM.WW.Audit` `0.1.0` on the feed; adopted by all four (DEEP: canonical record everywhere).
 - ✅ Configuration — `ZB.MOM.WW.Configuration` `0.1.0` on the feed; adopted by all four.
@@ -177,8 +178,9 @@ ZB_LDAP_IT=1 dotnet test   # requires a reachable GLAuth (e.g. a sister repo's i
 **Open**
 
 - ⬜ Execute the G-7 clustered-replication plan (shared SQL-Server `ISecretStore`) — [`components/secrets/GAPS.md`](components/secrets/GAPS.md).
-- ⬜ Bump the three Auth consumers to `0.1.5` to pick up the SQLitePCLRaw security fix
+- ⬜ Bump the four Secrets consumers `0.1.2` → `0.1.3` (KEK rotation + the same security fix).
-  (mxaccessgw + HistorianGateway `0.1.4`→`0.1.5`, ScadaBridge `0.1.3`→`0.1.5`).
+- ⬜ Clear the pre-existing `AngleSharp` NU1902 build break in ScadaBridge `CentralUI.Tests`
+  and HistorianGateway `Tests` — both fail full-solution builds under `TreatWarningsAsErrors`.
 - ⬜ Adopt `ZB.MOM.WW.LocalDb` in an app — no consumer references it yet.
 - ⬜ Give LocalDb a `components/localdb/` entry; it is the one shared lib whose design lives only in
   [`docs/plans/2026-07-17-localdb-design.md`](docs/plans/2026-07-17-localdb-design.md).

components/auth/GAPS.md

@@ -8,9 +8,18 @@ reach the shared `ZB.MOM.WW.Auth` library. Status legend: ⛔ gap · 🟡 partia
 > `SQLitePCLRaw.lib.e_sqlite3 2.1.11` (GHSA-2m69-gcr7-jv3q). `0.1.5` pins the patched `2.1.12`
 > (same approach as `ZB.MOM.WW.LocalDb`); the `.nuspec` declares it directly, so consumers get
 > the fix on bump without pinning themselves. **No API change** — `0.1.5` is `0.1.4` plus the pin.
-> **All three ApiKeys consumers are still on vulnerable versions** (mxaccessgw `0.1.4`,
+> **All three consumers bumped to `0.1.5` the same day** (mxaccessgw `e107019`, ScadaBridge
-> HistorianGateway `0.1.4`, ScadaBridge `0.1.3`) → bump to `0.1.5`. Note ScadaBridge's
+> `50d79ed1`, HistorianGateway `df211ee` — all pushed). Exposure was verified per repo rather
-> `0.1.3`→`0.1.5` jump also crosses the `0.1.4` `ExpiresUtc` verifier change.
+> than assumed: mxaccessgw and ScadaBridge genuinely resolved the vulnerable `2.1.11` and now
+> resolve `2.1.12`; **HistorianGateway was never exposed** (already resolved `3.50.3` via another
+> dependency), so its bump is consistency-only. ScadaBridge's `0.1.3`→`0.1.5` jump crosses the
+> `0.1.4` `ExpiresUtc` change, but that was additive — no source changes were needed and its
+> suites match baseline exactly (Security 181, InboundAPI 269). **OtOpcUa stays at `0.1.1`** and
+> was never exposed: it takes no `ApiKeys`/SQLite dependency.
+>
+> ⚠️ **Caveat:** HistorianGateway's bump could NOT be test-verified — a pre-existing, unrelated
+> `AngleSharp` NU1902 error blocks its test project under `TreatWarningsAsErrors` (ScadaBridge's
+> `CentralUI.Tests` has the same break). Both confirmed present on clean trees beforehand.
 >
 > **Current state (verified 2026-07-18):** feed carries `0.1.0`–`0.1.5`; consumer pins are
 > OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway `0.1.4`, **HistorianGateway `0.1.4`**