docs: wiki staleness sweep (Fable-orchestrated Opus audit)

Audited all 40 docs/ against the live codebase; fixed factual staleness in 23,
14 were clean. Highlights (all verified against code):
- equipment -> machines (ADR-011 rename) in INSTALL/DEPLOY-WINDOWS-IIS,
  PLUGIN-GUIDE, GE-ENFORCE, ROADMAP.
- Versions refreshed: contract 0.10.0 -> 0.13.0, product 0.5.0 -> 0.7.0, plus
  plugin example core_version pins.
- Bundled set corrected to the current 13 (PLUGINS.md 7 -> 13 rows; DEPLOY
  eleven -> thirteen).
- Per-plugin Alembic chain workflow (ADR-008) replacing stale core-chain steps
  in PLUGIN-QUICKSTART / BACKUP-RESTORE; deploy adds plugin upgrade-all.
- Frontend plugin staging (ADR-010) replacing 'no frontend plugin system yet'
  in PLUGIN-GUIDE; view/route paths repointed to plugins/<name>/frontend/.
- Corrected file paths (MapView.vue, manifest_schema.json), CLI (shelf-list),
  API gating (GET /api/plugins is optional-jwt), WJF 15 -> 16 stages, and
  retired Collector/PC-Types settings pages (ADR-012).
- ge-enforce proposal marked ACCEPTED/built.

docs/COLLECTOR-INTEGRATION.md

@@ -78,9 +78,10 @@ suspended for it, so the token is contained to the collector API even though its
 owner is an admin - it cannot act with admin authority anywhere.
 
 1. Settings > API Tokens > New Token.
-2. Click the **Collector service token** preset (pre-selects only
-   `collector.ingest`), name it (e.g. `wj-fleet-collector`), optionally set an
-   expiry, Create.
+2. Check **Restrict permissions**, then in the permissions grid tick only
+   **Submit collector payloads (fleet reporting)** (the `collector.ingest`
+   permission under the Collector category). Name it (e.g. `wj-fleet-collector`),
+   optionally set an expiry, Create.
 3. Copy the `shopdb_pat_...` secret (shown once) and deploy it to the fleet the
    same way as the env key: the `collectorApiKey` field in per-site
    `site-config.json` (see "Delivering the API key to clients" below). The
@@ -244,10 +245,12 @@ the PCs that use it (both render in the shared Relationships card).
 ### pc-type mapping (configurable per site)
 
 `pctype` (e.g. `gea-shopfloor-cmm`) maps to a shopdb Computer Type through
-`pctypemap_<pxetype>` settings (Settings > Collector PC Types).
-Defaults live in `plugins/computers/pctypemap.py` and are seeded on plugin
-install; edit per site in the UI. Unmapped pc-types produce a warning, not a
-failure.
+`pctypemap_<pxetype>` settings. The "Collector PC Types" settings page is
+retired (ADR-012): pc-type-to-Computer-Type handling now lives in GE-Enforce
+(each imaging PC type is a manifest scope with its own `computertypeid`). The
+built-in defaults in `plugins/computers/pctypemap.py` are still seeded on plugin
+install and the collector still reads them, so existing enrollment keeps
+working. Unmapped pc-types produce a warning, not a failure.
 
 ### Classic api.asp field mapping (for porting the PowerShell reporter)