docs: correct Jellyfin admin-password claim (archive OCR corruption); prepare Mac WG peer

serverAppConfigs-docs/Dankserver/Jellyfin.md

@@ -102,9 +102,11 @@ cgroup regardless of `GroupAdd=keep-groups`.
 ## Authentication
 
 - **Built-in auth:** per-user libraries, parental controls, max bitrate
-  limits. The local `dank` admin account is built-in and its password is
-  Frank's — never recorded in this repo (the bootstrap-era value no longer
-  authenticates on the live database).
+  limits. The local `dank` admin account is built-in; its password is
+  Frank's bootstrap value — never recorded in this repo. (2026-09-01: a
+  corrupted session-archive reading briefly suggested the password had
+  changed; verified offline against the stored PBKDF2-SHA512 hash, the
+  bootstrap value still authenticates.)
 - **LDAP via Authentik (live 2026-09-01):** the LDAP-Auth plugin
   authenticates users against the authentik LDAP outpost on Dankclaw — see
   [[Authentik]] for the outpost unit, provider, and RBAC objects.

serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md

@@ -31,6 +31,40 @@ kill SearXNG), `deploy_frankbook_stack` **skips** gluetun and qbittorrent
 with instructions and deploys the five arrs anyway. The qB WebUI port stays
 unpublished by design; the e2e torrent test waits on the credentials.
 
+### Prepared Mac peer (2026-09-01 — waiting on server-side add)
+
+A dedicated keypair is generated and parked on Dankclaw
+(`~/frankbook-wg/mac-private.key`, 0600, host-local — never in the repo).
+Lighting the tunnel needs exactly one change on the WireGuard server
+(149.102.254.77): register a new peer for the Mac — different keypair from
+Dankclaw's (one key cannot serve two machines; the server bounces the
+endpoint between them), same endpoint and server key:
+
+- Server pubkey (route target): `utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=`
+- Endpoint: `149.102.254.77:51820` (`VPN_SERVICE_PROVIDER=custom`)
+- Mac public key to register as the new peer:
+  `QIoCwI+9VuiWldRvUfPpTfXq7UVVBFynIqYb2vqHtQo=`
+- Allocate the Mac a fresh tunnel IP as the peer's allowed IP — Dankclaw
+  holds `10.2.0.2/32`, so likely `10.2.0.3/32` unless the server numbers
+  differently.
+
+Then `/home/core/Containers/gluetun/env` (0600) inside the VM:
+
+    VPN_SERVICE_PROVIDER=custom
+    VPN_TYPE=wireguard
+    WIREGUARD_PRIVATE_KEY=<raw b64 private key — fetch from dankclaw:~/frankbook-wg/mac-private.key>
+    WIREGUARD_ADDRESSES=<allocated tunnel IP>/32
+    WIREGUARD_PUBLIC_KEY=utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=
+    WIREGUARD_ENDPOINT_IP=149.102.254.77
+    WIREGUARD_ENDPOINT_PORT=51820
+    WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
+    WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
+
+Deploy with `./scripts/deploy.sh frankbook-pro --service gluetun --service
+qbittorrent`, then verify egress from the VM (`podman exec gluetun curl -s
+ifconfig.me` must NOT show the residential IP) before declaring the
+BitTorrent port usable.
+
 ## Deploy flow
 
 Same deployer as every host: `./scripts/deploy.sh frankbook-pro --service

serverAppConfigs-docs/log.md

@@ -45,8 +45,9 @@ timestamp: 2026-09-14
   End-to-end verified with a throwaway `jellyfin_users` member
   (`AuthenticateByName` 200, non-admin policy), then removed from both
   authentik and the Jellyfin DB directly (its admin-token cleanup 401'd —
-  the local `dank` admin password on the live DB is Frank's, not the
-  bootstrap-era value; notated in the Jellyfin doc).
+  the admin password in the session archive was OCR-corrupted; verified
+  offline against the stored PBKDF2-SHA512 hash that the real bootstrap
+  value still authenticates, unchanged).
 - Docs: [[Authentik]] gained the LDAP-outpost section (objects table +
   rules), [[Jellyfin]] gained the LDAP-Auth plugin section. Docs-only
   commit → deploy no-op.