Go-live: Monitors and Backups verified on Prod (#85, #87)

Uptime-Kuma stood up on ONE with the four Prod monitors green and
Matrix alerting into the existing Trinity room (test alert confirmed);
the restore drill, now pointed at dorfteich-prod_backups, restored the
fresh set 20260712-183629 green (2 users, 16 pages). Only the optional
DEPLOY_SSH_KEY_PROD hygiene item remains open.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1

deploy/go-live.md

@@ -32,27 +32,40 @@ the DNS switch.
 
 ## Operator items (block the DNS switch)
 
-- [ ] **Prod host decision confirmed** (working default: ONE, where
+- [x] **Prod host decision confirmed** (working default: ONE, where
       Test/Int and the registry already live — one host, no BASEL yet).
-- [ ] **DNS**: point `dorfteich.online` at ONE (today it still points at
+- [x] **DNS**: point `dorfteich.online` at ONE (today it still points at
       the old VPS `188.245.116.44`).
-- [ ] **Caddy**: activate the prepared `dorfteich.online` block in
+- [x] **Caddy**: activate the prepared `dorfteich.online` block in
       `/etc/caddy/Caddyfile` on ONE (ports 8120–8122) after DNS,
       `systemctl reload caddy`, verify the Let's Encrypt certificate —
       this also closes the #88 item "ACME exercised on a real domain".
-- [ ] **First-run setup**: run the wizard on the fresh instance (or set
+- [x] **First-run setup**: run the wizard on the fresh instance (or set
       the `SETUP_ADMIN_*` preseed in the Prod `.env` before first boot) —
       creates the Site Admin.
-- [ ] **Prod SMTP**: configure a production relay (wizard step or `.env`);
+- [x] **Prod SMTP**: configure a production relay (wizard step or `.env`);
       the Prod `.env` ships without SMTP on purpose.
-- [ ] **Legal texts** (#82): paste the real dorfteich.online imprint and
+- [x] **Legal texts** (#82): paste the real dorfteich.online imprint and
       privacy policy in Administration → Legal pages.
-- [ ] **Monitors** (#85): create the Prod monitor set from
-      `deploy/monitoring.md` in Uptime-Kuma, with alerting; verify one
-      test alert fires.
-- [ ] **Backups verified on Prod** (#87): switch the drill's
-      `DRILL_SOURCE_VOLUME` to `dorfteich-prod_backups` and run one
-      on-demand drill (`drill-*` tag) green.
+- [x] **Monitors** (#85, done 2026-07-12): a fresh Uptime-Kuma runs on
+      ONE (`kuma.101010.cloud`, `/home/DOCKER/uptime-kuma/`, bound to
+      127.0.0.1:8130 behind Caddy). All four Prod monitors from
+      `deploy/monitoring.md` are live and green (`prod web`,
+      `prod api ready`, `prod api degraded` keyword, `prod collab`
+      via the `/collab/healthz` fallback). Alerting goes to the existing
+      Trinity Matrix room (`!RtztXRBVkQJgUwpGXx`, same channel as the
+      website monitoring, target `@stwaidele:trinity.101010.cloud`); a
+      test DOWN alert was confirmed delivered. Kuma admin login and the
+      Matrix access token live on the host (admin-password.txt); no
+      off-host Kuma yet (a host-total outage won't self-report).
+- [x] **Backups verified on Prod** (#87, done 2026-07-12): the drill's
+      `DRILL_SOURCE_VOLUME` now points at `dorfteich-prod_backups`
+      (commit `a35f713`). An on-demand drill against the fresh Prod set
+      `20260712-183629` restored green — readyz ok, `2 users, 16 pages`
+      (logged on issue #98). Note: the very first Prod backup
+      (`20260712-135349`) predated the wizard and had no users, so a
+      drill needs a backup taken *after* real content exists — trigger
+      "Back up now" once after go-live, as was done here.
 - [x] **Off-host mirror** (#84, done 2026-07-12): tunnel fixed, BASEL
       provisioned (`deploy/backup-basel.md`), mirror live on Test AND on
       Prod since the v0.2.0 deploy (first run verified: all sets on