Protect RCON diagnostics and redact player addresses (Refs #61)

docs/guides/authentication.md

@@ -34,7 +34,7 @@ guessable token. An unset setup token holds setup closed.
 | Capability | Viewer | Operator | Administrator |
 | --- | --- | --- | --- |
 | Fleet, metrics, matches and operation summaries | Yes | Yes | Yes |
-| Raw configs, file diffs, logs and telemetry diagnostics | No | Yes | Yes |
+| Raw configs, file diffs, logs, RCON and telemetry diagnostics | No | Yes | Yes |
 | Deploy/start/stop/restart/rebuild/remove servers | No | Yes | Yes |
 | Scripts, plugins, configs, campaigns, betas and collections | Read summaries | Manage | Manage |
 | Host setup, deletion, enrollment, credentials, runtime preparation and game-file upload/cache | Read status | Read status | Manage |
@@ -47,6 +47,11 @@ cannot save keys indirectly through a launch request. An operator's content
 permissions include executable scripts and plugins; assign that role only to
 people trusted to operate the game fleet.
 
+RCON failure replies are available only to operators and administrators in the
+server's Diagnostics tab. Player addresses are redacted before diagnostics are
+saved; successful checks clear the saved reply. Fleet snapshots and live status
+streams contain no reply snippets. Upgrades discard older saved RCON snippets.
+
 Permissions are checked on the server for API calls, normal pages and Svelte
 page-data requests. Hiding UI controls is a convenience, not the access boundary.
 The controller prevents disabling or demoting the last enabled administrator.