Correct the stale and false comments and docs the comprehension seats flagged

examples/plugins/auth-admin/README.md

@@ -46,7 +46,7 @@ A grant of a name no installed plugin declares is listed apart on the same page,
 
 ## Layout
 
-- `plugin.ts` — the manifest: the Admin nav fragment, the six permissions the plugin declares, and
+- `plugin.ts` — the manifest: the Admin nav fragment, the seven permissions the plugin declares, and
   the route table — one thin handler per method+path, gated via `permissionName(resource, actionForMethod(method))`
   so a GET needs `:read` and a POST `:write`.
 - `admin-grants.ts` — the permission picker and the grant diff, shared by the Users and Groups

examples/plugins/auth-admin/admin-groups.ts

@@ -15,7 +15,7 @@ const GROUP_NS = "Group";
 const MEMBERS = "members";
 const DEFAULT_PAGE_SIZE = 25;
 const PAGE_SIZES = [25, 50, 100];
-// One Keto page of candidate users is fetched for the member pickers (mirrors admin-users).
+// One Kratos `listIdentities` page of candidate users is fetched for the member pickers (mirrors admin-users).
 const LIST_FETCH_SIZE = 250;
 const GROUP_NAME = /^[a-z0-9][a-z0-9_-]*$/; // URL-safe; doubles as the path segment
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; // a Kratos identity id

examples/plugins/auth-admin/views/partials/group-detail-body.ejs

@@ -1,9 +1,11 @@
 <%#
   Admin group membership body, captured into the shell content slot. Config:
     group   { name }
-    members { action, rows: { kind:"group"|"identity", label, subject }[] }   action = remove-member endpoint
+    members { action, rows: { kind:"group"|"user", label, subject }[] }   action = remove-member endpoint
     add     { action, options: {label,value}[] }                          action = add-member endpoint
     del     { action }                                                     delete the whole group
+    canWrite?     false (a `groups:read` holder) drops the add, remove and delete forms
+    permissions?  PermissionPicker; when set, the group's permission picker is rendered
     csrfToken, error?
 %><%
   const group = locals.group;