docs: infrastructure audit — app inventory, backups, CI, provider pricing, agent fleet

Audit of the operator docs against live reality (2026-11-04):
- app-inventory.md: all 19 Cloudron apps with id, fqdn and registry image pin.
  Corrects the portal path (code/member-portal, not co-op/member-portal) and the
  panel path (local/coop.inference.admin-panel, not code/admin-panel).
- maintenance/backups.md: the two backup systems; the deliberate per-user restic
  cache split and the --group-by "" retention fix, with why.
- maintenance/woodpecker-ci.md: CI server + agent, image build/pin, manual-only
  trigger, git-lfs requirement, and its current not-yet-green state (agent's
  job-collection long-poll gets HTTP 500 from the server).
- provider-pricing/: index + GreenPT, Tinfoil (local EHBP proxy architecture) and
  the Metis /v1/systemone decision-model route; regolo.md updated to record the
  gateway prices were applied.
- agent-fleet.md: steward, infrastructure-bot and socialbot (Unix users, gateway
  units, teams); member-bot tier 2 planned but not yet provisioned.
- README: file list; operator-token-runbook: correct the membership_sweep cadence
  (3x daily, not nightly); migration doc: post-migration addendum (16->19 apps,
  DNS split resolved, old box still on with apps stopped).

migration/cloudron-server-migration.md

@@ -508,3 +508,57 @@ access removed 2026-11-02 — retirement begun; app restored and safe in backups
 **Outstanding:** tonight 23:00 UTC first backup (verify `normal`, ~4.9 GiB); Cloudron subscription
 page check on the new dashboard; my primary model route re-heals on its own (fallback worked all
 night); old box keep powered-on/apps-stopped/backups-disabled for a few days, then decommission.
+
+---
+
+# POST-MIGRATION ADDENDUM — 2026-11-04
+
+Recorded by the infra-docs audit. This section is current state; everything above
+is the as-it-happened record.
+
+## App count: 16 → 19 (three apps added since cutover)
+
+The migration restored **16 apps**. Since then the server carries **19** — the
+three new ones are the docs site, the CI server and the CI agent. See
+`app-inventory.md` for the full list. Anywhere above that says "16 apps" is the
+state at cutover, not today.
+
+| New since 2026-11-02 | FQDN | Cloudron id |
+|---|---|---|
+| Docs site (Surfer) | `docs.inference.coop` | `85b7ce06-e2af-49a4-bd4f-a9c2e692e3ab` |
+| Woodpecker CI server | `ci.inference.coop` | `4984f95e-0c0a-4af3-9ce1-4ca4f3e8483d` |
+| Woodpecker CI agent (custom) | `ci-agent.inference.coop` | `5ac63873-cf2c-4ad9-acd6-81dc0e016c83` |
+
+## The DNS "split" is resolved — no hostname is served by the old box
+
+At one point `chat.inference.coop` and `portal.inference.coop` were observed still
+resolving to the **old** box (`179.199.135.72`) while `gateway`/`my`/`docs` were on
+the **new** box (`179.237.86.116`). **As of 2026-11-04 there is no such split:**
+every hostname — `chat`, `portal`, `gateway`, `my`, `docs`, `ci`, `ci-agent`,
+`matrix`, `git`, `www` and the apex — resolves to the **new** box.
+
+The zone is **wildcarded**, so a resolving name proves nothing by itself. The
+decisive fact: a **made-up** hostname (`zzznope.inference.coop`) also answers the
+**new** box `179.237.86.116` at the authoritative nameservers (`ns1.yoursrs.com`).
+That means the **wildcard itself now points at the new box**, so no name is being
+served by the old box via the wildcard either.
+
+## The old box still exists (rollback), and serves nothing
+
+- `179.199.135.72` is **still powered on** and answers on 22/80/443/587/993, **but
+  it hosts no running app.** A request with `Host: chat.inference.coop` returns
+  Cloudron's **"app down / Not Found" fallback page**, and its TLS certificate has
+  an **empty subject** — the signature of a Cloudron whose vhost's app is stopped,
+  exactly as documented ("powered on with apps stopped").
+- **No DNS reference points at it**, so it receives no real traffic.
+- **Decommission is still pending** — this is the one open item from the cutover
+  that has not happened. Its backup schedule must remain **disabled** while it is
+  kept (two boxes on one S3 bucket interleave and prune each other's backups).
+
+## Still unresolved / for the operator
+
+- **Decommission the old box** (`179.199.135.72`) when rollback is no longer
+  wanted, after confirming the new box's backups are proven.
+- **Member mailbox contents** — the long-standing unknown from §7 (whether
+  members' mail is inside the Cloudron backup) still needs a real IMAP login to
+  confirm.