migration: credentials status + the ready-to-post announcement

Backup passphrase confirmed off-box by the operator 2026-10-30 (was the blocker). Outstanding: S3 secretAccessKey (absent from the off-box JSON) and the Vault export. Announcement drafted for #updates with placeholders for the window.

cloudron-server-migration.md

@@ -168,6 +168,27 @@ API-key count, ledger rows, `metrics_daily` rows, Gitea repo count). Capture not
 further; after the restore, diff it. A silently-empty app is exactly what a diff catches
 and a spot-check misses.
 
+## Credentials needed on the day
+
+Status as of 2026-10-30:
+
+- [x] **Cloudron backup passphrase** — the operator holds it off-box (confirmed 2026-10-30). A restore
+      asks for this first; without it the backup is unreadable, so this was the real blocker.
+- [ ] **S3 `secretAccessKey`** — **not** in the off-box JSON, which carries `accessKeyId` only.
+      Retrieve it from the Infomaniak console and keep it with the passphrase. A restore begins by
+      pointing the new Cloudron at the backup target, so it must be in hand before the window opens.
+- [ ] **Vault export** — the Vault is an app on the box being migrated, so its contents are not
+      off-box until exported. Take the export before the freeze.
+- [x] **restic passphrase** (agent host, different backup) — in that host's `.env`, and that host is
+      not the one migrating, so it stays recoverable either way.
+
+## The announcement, ready to post in #updates
+
+> **Scheduled maintenance: <day>, <date>, <start>–<end> UTC.** We are moving our servers to a new host
+> in Switzerland. Chat, the portal, the API and the website will be unavailable during the window. No
+> data is being changed or removed — this is a move, not a rebuild. If anything still looks wrong
+> afterwards, reply here and we will sort it out.
+
 ## 4. Cutover, in order
 
 1. **Freeze writes.** Pause the portal's `membership_sweep` and `rag_refresh`, hold