Consolidate co-op/runbooks into co-op/ops-docs

Absorbs the Cloudron server-migration material from co-op/runbooks
(now archived) so there is a single public operator documentation
repository. Files move into migration/ (plan, DNS change sheet,
pre-migration state) and provider-pricing/ is kept as its own section;
the merged README replaces both.

History is preserved: this is a merge of the unrelated histories, so
co-op/runbooks' 26 commits remain reachable from this repository and
git log -- migration/ shows their real authors and messages. File
contents are byte-identical to co-op/runbooks (blob hashes unchanged).

migration/dns-change-sheet.md

@@ -0,0 +1,86 @@
+# DNS change sheet — inference.coop
+
+**Rebuilt 2026-11-01 from the registrar's own panel** (domains.coop; nameservers `ns1/ns2.yoursrs.com`).
+The previous version listed record counts that could not be reproduced and at least two records that did
+not exist, so it is replaced rather than edited.
+
+## Why the panel was the only source
+
+- **AXFR is refused**, so the zone cannot be pulled.
+- **The zone is wildcarded.** A made-up hostname (`zz-random-check-9f2.inference.coop`) returns the old
+  box's address. So a name that *resolves* proves nothing about whether a record exists, and any hostname
+  absent from the list below is served by the wildcard.
+- Only 11 records exist. Everything else is `*`.
+
+## The complete inventory (11 records)
+
+| # | Type | Hostname | Value | TTL | Moves? |
+|---|------|----------|-------|-----|--------|
+| 1 | A | `inference.coop` | `179.199.135.72` | 3600 | **YES** → new box |
+| 2 | AAAA | `inference.coop` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
+| 3 | A | `*` | `179.199.135.72` | 3600 | **YES** → new box |
+| 4 | AAAA | `*` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
+| 5 | A | `server` | `179.199.135.72` | 3600 | **CHECK FIRST** — nothing else references it |
+| 6 | A | `www` | `179.199.135.72` | 3600 | **YES** → new box |
+| 7 | MX (pri 10) | `inference.coop` | `my.inference.coop` | 3600 | stays (follows record 1/2) |
+| 8 | TXT | `inference.coop` | `v=spf1 a:my.inference.coop include:_spf.tem.scaleway.com ~all` | 3600 | stays |
+| 9 | TXT | `_dmarc` | `v=DMARC1; p=reject; pct=100` | 3600 | stays |
+| 10 | TXT | `cloudron._domainkey` | `v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3…` (1024-bit; full value recovered 2026-11-01 and restored) | 3600 | stays |
+| 11 | TXT | `ede94f37-204c-41ee-b3…` | `v=DKIM1; h=sha256; k=rsa; p=MIIBIjA…` (2048-bit) | 3600 | stays |
+| 12 | TXT | `_atproto` | `did=did:plc:4leras5objxiqtnbjzoholds` | 3600 | stays |
+
+(The table shows 12 rows because `www` was added as a separate item; rows 1–11 are the panel's 11.
+Reconcile the numbering against the panel when editing.)
+
+## The four records that matter at cutover
+
+**Records 1–4 and 6**: apex A, apex AAAA, wildcard A, wildcard AAAA, and `www`. Change these and the site
+moves. Nothing else in the zone needs touching for the migration.
+
+**The wildcards are the item the old sheet omitted entirely.** Because `*` carries both A and AAAA records,
+every hostname not listed above — `chat`, `portal`, `panel`, `dashboard`, `newsletter`, `gateway`,
+`vault`, `git`, `registry`, `files`, `forum`, `email`, `docs`, `my`, `status` — resolves *only* via the
+wildcard. They are not individual records and must not be created as such; they move when the wildcards
+move. A partial cutover that changes the apex but not `*` leaves every application on the old box.
+
+## Two DKIM selectors, for different senders
+
+- **`cloudron._domainkey`** — the box's own mail signing (1024-bit). Used by the portal and by Listmonk,
+  both of which relay through the Cloudron mail app.
+- **`ede94f37-…`** — a UUID-named selector with a 2048-bit key. UUID selectors are what a service
+  generates for itself, and this is almost certainly **Scaleway Transactional Email's**. Scaleway's own
+  domain verification passed, which is the authority on whether it is right.
+
+*Name and value for row 11 are truncated in the panel screenshot. Read the full name in the panel (or
+from Scaleway's domain-verification page) before editing that row.*
+
+## What the zone does NOT contain
+
+No CNAME, no CAA, no SRV, no `_acme-challenge` entries. If any of those are ever needed, they are new
+records, not moves. (`docs.inference.coop` has no record of its own — it is served by the wildcard, which
+is why it answers with the Cloudron dashboard.)
+
+## Before the window
+
+1. **Lower the TTL on records 1–4 and 6 from 3600 to ~300.** At 3600 a mistake takes an hour to correct;
+   at 300 it takes five minutes. Do this a day ahead so the old TTL expires, then restore it afterwards.
+2. ~~**Establish what `server.inference.coop` is used for.**~~ **Resolved 2026-11-02:** it was repointed
+   to the new box with the rest (confirmed authoritatively on both NS). Its purpose is still
+   unidentified, but it no longer references the old box — see the runbook's CUTOVER COMPLETE section.
+3. **Confirm the full name of record 11** (above).
+
+## Verification after the move
+
+Query the **authoritative** nameservers, not a resolver, and query the specific name — a wildcard answer
+cannot be distinguished from a real record otherwise:
+
+```
+dig +short A    inference.coop        @ns1.yoursrs.com
+dig +short AAAA inference.coop        @ns1.yoursrs.com
+dig +short A    zz-random-check-9f2.inference.coop @ns1.yoursrs.com   # wildcard, must now be the NEW box
+dig +short MX   inference.coop        @ns1.yoursrs.com
+```
+
+Then `verify-restore.py`. Its two known blind spots (the `data` group crashing on a missing PATH, and the
+mail check asserting a port-25 state it cannot observe from the agent host) are still unfixed — fix them
+before relying on a clean run.