docs(setup-app): correct Advanced-group nav list + note JWKS gating (ADR-0066 ④)

The Advanced table listed Verifications and Device Codes, but those nav
entries were deliberately removed (sensitive ephemeral secrets — not
browsable; see setup-nav.contributions.ts). Also document that nav_jwks is
capability-gated and sys_jwks is private-posture.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0187GeNqezxV6g5jiLiggfbt

Author: claude

content/docs/ui/setup-app.mdx

@@ -56,7 +56,7 @@ anchors are:
 | **Configuration** (`group_configuration`) | All Settings · Branding · Authentication · Email · File Storage · AI & Embedder · Knowledge · Feature Flags — `platform-objects` |
 | **Diagnostics** (`group_diagnostics`) | Sessions · Notification Events — `platform-objects`; Audit Logs — `plugin-audit` |
 | **Integrations** (`group_integrations`) | `plugin-webhooks` |
-| **Advanced** (`group_advanced`) | OAuth Applications · Signing Keys (JWKS) · Verifications · Device Codes · Identity Links · User Preferences — `platform-objects` |
+| **Advanced** (`group_advanced`) | OAuth Applications · Signing Keys (JWKS) · Identity Links · User Preferences — `platform-objects` |
 
 The exact rendered menu depends on which capability plugins are loaded.
 A few notable entries:
@@ -66,7 +66,12 @@ A few notable entries:
 - **OAuth Applications** (`sys_oauth_application`) — third-party OAuth
   client registrations, contributed into `group_advanced`.
 - **Signing Keys (JWKS)** (`sys_jwks`) — JWKS keys used for OIDC / JWT
-  signing, contributed into `group_advanced`.
+  signing, contributed into `group_advanced`. The nav item is gated on the
+  `manage_platform_settings` capability, and the object itself is
+  `access: { default: 'private' }` (ADR-0066 ④) — signing keys are never
+  covered by the wildcard grant, so non-admins are denied server-side.
+  (`sys_verification` and `sys_device_code` are deliberately **not** in the
+  nav: sensitive, ephemeral secrets — not browsable, and also `private`.)
 - **Audit Logs** (`sys_audit_log`) — contributed by `plugin-audit` into
   `group_diagnostics`. (The `sys_activity` and `sys_comment` objects also
   live in `plugin-audit`, but they are not contributed as Setup nav