Reconcile docs with current functionality (audit fixes)

[yashau]

Full documentation audit of all 73 doc pages against the current codebase (routes, RBAC catalog, DB schema, config/env, metrics, mise tasks, agent CLI, console pages). This PR fixes the drift that was found. The large majority of pages were already accurate; changes are concentrated where reality had moved.

Reference

• api.md — meter-frame audit perm —→node:control; add claim-next-group, controller-settings (GET/PATCH /settings/controller), PUT …/channel-rooms, GET /nodes/agent-release, profile/watchdog POST create, and GET /readyz.
• configuration.md — document the recorder-agent update-check env family (RAKKR_AGENT_RELEASE_*, RAKKR_GITHUB_*), RAKKR_AUTH_FALLBACK_GRACE_MS, RAKKR_RECORDING_CACHE_MAX_BYTES, RAKKR_OIDC_ALLOW_INSECURE_ISSUER.
• tasks.md — add helm:check, node:test-db, nodes:check-lifecycle, and the release task.
• metrics.md — note the channel-correlation peer_channel/phase labels and the listen-monitor source label.
• recorder-agent.md — add RAKKR_CAPTURE_CHUNK_SECONDS/--capture-chunk-seconds and --version.

Architecture

• Reflect the module refactor: schema.ts and shared/src/index.ts are re-export barrels; requirePermission is created in index-authorization.ts; a global app.onError maps DB-unavailable→503 / else→500. Migration count 0039→0046. Overview diagram now lists the 6th (switcher-routing) runner.

Getting-started / guides

• concepts.md — add the provisioning node status; replace the legacy "upload provider" glossary with destinations + policies (list fan-out).
• audio-enhancement.md — correct the filter-chain order (denoise runs first; low-pass after high-pass).
• authentication-and-rbac.md — clarify roles are "narrower in scope" (auditor isn't a subset of viewer).

How-to (console label/behavior drift)

Corrected: recording-profiles (removed the non-existent "Enabled" toggle; "Chunk Length"), channel-maps (target-agnostic template; real Mode names; "Promote"), manage-users ("Edit access" = roles/groups/scopes; "Add user"), "Add group"/"Add schedule", health-alert inline actions (Ack / Mute 1h), watchdog speech-mode not console-editable, node status vocab, install one-liner --site/--room, room "node inventory", "Requested channels are already in use", and the recording-job status list (no claimed status; add stop_requested).

Two code bugs found in passing

• apps/web/src/pages/room-detail.tsx — delete-refusal message said the room "still has nodes assigned," but the 409 is raised for schedules (nodes are SET NULL). Corrected both the toast and the confirm dialog.
• packages/shared/src/enhancement.ts — stale enhancement-chain comment (denoise order / missing low-pass).

Verification

node:check, node:lint, node:format-check, check:loc, all 14 baseline verifiers, docs:build (54 pages, no MDX/link errors), and node:test all pass locally.

Scope note: docs/internal/audits/* (historical) and docs/internal/design/* (point-in-time) were not line-audited; docs/internal/baselines/* are machine-verified by the verify-*-baseline.mjs gates.

🤖 Generated with Claude Code