Track Cloudron 10 follow-ups and add SSO migration plan

operator-token-runbook.md

@@ -3,6 +3,24 @@
 How the co-op's Cloudron credentials are organized, and how to rotate them
 without breaking the stack.
 
+## Cloudron 10 follow-ups (tracked, Sept 2026)
+
+Two items surfaced by the Cloudron 10 release. Neither is urgent — both apps
+still work — but both are scheduled deliberately so they're fixed *before* the
+membership grows.
+
+1. **Migrate webmail off SnappyMail → Cloudron "Mail".** SnappyMail (RainLoop's
+   fork) is abandoned; Cloudron built its own replacement, "Mail," but it is
+   still catching up on features (their words). Keep SnappyMail for now; migrate
+   `mail.inference.coop` once "Mail" is feature-complete. Until then SnappyMail
+   is a known unmaintained dependency.
+
+2. **Migrate `dashboard` + `panel` from `proxyAuth` → OIDC.** Cloudron 10 is
+   phasing out proxyAuth/LDAP in favor of OIDC (93 packages on OIDC vs 11 on
+   proxyAuth). Our two custom apps (`member-dashboard`, `admin-panel`) still use
+   the `proxyAuth` addon; the portal and all App Store apps are already on OIDC.
+   See [SSO migration plan](sso-migration.md).
+
 ## The two-token split
 
 There are **two separate** Cloudron API tokens, deliberately decoupled so