HandySolo, your .htaccess feng shui is good: it appears to have healed my woes.
So this directive stops the .htaccess directory inheriting the default mod_security settings. Surely this is always an issue for servers running mod_security? Is there a reason the WP installation doesn’t include a .htaccess file with that directive by default?
Anyway, thanks very much.