docs: clarify Polygon auth and API contracts

site/routes/operations_routes.py

@@ -169,12 +169,16 @@ def create_operation():
     )
     if target_op is None:
         return jsonify({"error": f"operation '{operation}' not found for service"}), 404
+    if target_op.get("operation") != operation:
+        return jsonify({"error": "operation does not match svcOperationId"}), 400
 
     kind = target_op.get("kind", "instance")
     action = target_op.get("action", operation)
 
     # Создать операцию в MockState (dtFinish=None — ещё не выполнена)
-    op_uid = state.create_operation(instance_uid, svc_op_id, operation, kind, action)
+    op_uid = state.create_operation(
+        instance_uid, svc_op_id, target_op["operation"], kind, action
+    )
 
     # ⛔ Location ОБЯЗАТЕЛЕН — без него executor не получит opUid
     resp = make_response(jsonify({"instanceOperationUid": op_uid}), 201)