32fd953969
Per-app cutover steps mapped to the library surface; flags 5 findings that change the plan (OtOpcUa section is Security:Ldap not Authentication:Ldap; singleton 'bug' already mitigated; ScadaBridge inbound API keys are a re-architecture not a reformat; OtOpcUa config+DB mapping + DevStubMode + 2nd LDAP consumer; MxGateway ApiKeys is the low-risk donor path).