docs: wiki staleness sweep (Fable-orchestrated Opus audit)

Audited all 40 docs/ against the live codebase; fixed factual staleness in 23,
14 were clean. Highlights (all verified against code):
- equipment -> machines (ADR-011 rename) in INSTALL/DEPLOY-WINDOWS-IIS,
  PLUGIN-GUIDE, GE-ENFORCE, ROADMAP.
- Versions refreshed: contract 0.10.0 -> 0.13.0, product 0.5.0 -> 0.7.0, plus
  plugin example core_version pins.
- Bundled set corrected to the current 13 (PLUGINS.md 7 -> 13 rows; DEPLOY
  eleven -> thirteen).
- Per-plugin Alembic chain workflow (ADR-008) replacing stale core-chain steps
  in PLUGIN-QUICKSTART / BACKUP-RESTORE; deploy adds plugin upgrade-all.
- Frontend plugin staging (ADR-010) replacing 'no frontend plugin system yet'
  in PLUGIN-GUIDE; view/route paths repointed to plugins/<name>/frontend/.
- Corrected file paths (MapView.vue, manifest_schema.json), CLI (shelf-list),
  API gating (GET /api/plugins is optional-jwt), WJF 15 -> 16 stages, and
  retired Collector/PC-Types settings pages (ADR-012).
- ge-enforce proposal marked ACCEPTED/built.

docs/adr/ADR-009-frontend-plugin-gating.md

@@ -41,7 +41,9 @@ list. This is the whole of what ships now.
    anonymous callers is safe because `GET /api/dashboard/navigation`
    already leaks the same enabled/disabled signal, and unauthenticated
    kiosk routes (`/tv`) need the answer too. It carries no metadata, so it
-   reveals strictly less than the admin-gated `GET /api/plugins`.
+   reveals strictly less than the equally-anonymous but metadata-carrying
+   `GET /api/plugins` (also `jwt_required(optional=True)`; only the
+   `PUT /api/plugins/<name>` toggle is admin-gated).
 
 2. **Route tagging.** Every plugin-owned route carries `meta.plugin =
    '<pluginname>'`. This covers the per-plugin route modules