migration: record the off-box credential state; one custodian is a co-op risk

Passphrase + Vaultwarden master password confirmed off-box in the operator's KeePass vault. S3 secretAccessKey still unconfirmed - the one credential not in the co-op's own JSON. Notes that the Vault is Vaultwarden (nothing to sync with Bitwarden) and that all break-glass copies sit with a single custodian.

cloudron-server-migration.md

@@ -172,16 +172,27 @@ and a spot-check misses.
 
 Status as of 2026-10-30:
 
-- [x] **Cloudron backup passphrase** — the operator holds it off-box (confirmed 2026-10-30). A restore
+- [x] **Cloudron backup passphrase** — off-box (confirmed 2026-10-30), in the operator's KeePass vault.
-      asks for this first; without it the backup is unreadable, so this was the real blocker.
+      A restore asks for this first; without it the backup is unreadable. This was the real blocker.
-- [ ] **S3 `secretAccessKey`** — **not** in the off-box JSON, which carries `accessKeyId` only.
+- [x] **Vaultwarden master password + admin credentials** — off-box in the same KeePass vault
-      Retrieve it from the Infomaniak console and keep it with the passphrase. A restore begins by
+      (2026-10-30). The Vault's own database is inside the Cloudron backup, so a restore returns it
-      pointing the new Cloudron at the backup target, so it must be in hand before the window opens.
+      whole; the master password is what makes the restored contents readable. Note the shape of this:
-- [ ] **Vault export** — the Vault is an app on the box being migrated, so its contents are not
+      `vault.inference.coop` runs `com.github.bitwardenrs` — **Vaultwarden**, the open-source Bitwarden
-      off-box until exported. Take the export before the freeze.
+      server — so official Bitwarden clients already work against it. There is nothing to sync.
+- [ ] **S3 `secretAccessKey`** — **confirm it is in the KeePass vault.** This is the one credential
+      absent from the co-op's own off-box JSON (that carries `accessKeyId` only), and a restore begins
+      by pointing the new Cloudron at the backup target — so it must be typeable before the window.
+- [ ] **Vault export** (optional insurance) — the contents already ride in the Cloudron backup, so this
+      is not the source of truth. Cheap protection against the app restoring but its DB coming back
+      damaged.
 - [x] **restic passphrase** (agent host, different backup) — in that host's `.env`, and that host is
       not the one migrating, so it stays recoverable either way.
 
+**Continuity, not just safety.** All of the above live in one person's KeePass file. For a
+co-operative that is a governance risk as much as an ops one: if the one custodian is unavailable, so
+is the infrastructure. The cheap fixes are a second custodian (or a sealed shared copy), and a line in
+this repo recording *where* the break-glass copies are held — never the secrets themselves.
+
 ## The announcement, ready to post in #updates
 
 > **Scheduled maintenance: <day>, <date>, <start>–<end> UTC.** We are moving our servers to a new host