ops: paivana and caddy config refresh

configs/notes/README.md

@@ -0,0 +1,65 @@
+# SilverBullet — SilverBullet on CachyOS (koopa)
+
+Cross-host markdown notes (magikoopa + clementine). Stack name **SilverBullet** (parked web UI). Product **FreeNotes** = separate native enc notes (not this stack).
+
+| Item | Value |
+|------|--------|
+| Stack | [SilverBullet](https://silverbullet.md/) server binary |
+| Image | `localhost/koopa-silverbullet:cachyos` (`FROM docker.io/cachyos/cachyos`) |
+| Live dir | `/home/hernani/koopa-silverbullet/` |
+| Container | `koopa-silverbullet` |
+| Host port | **9028** = Paivana paywall; app backend **127.0.0.1:19128** |
+| Public site | `silverbullet.hacktivism.ch` |
+| Auth | Paivana (GOA:42); no Caddy basic_auth |
+| Forgejo space backup | private `hernani/freenotes` (historical name; SB space only) |
+
+## Cutover freenotes → silverbullet (koopa)
+
+Live still may be `~/koopa-freenotes` / CT `koopa-freenotes`. Scripts default dry-run; `--apply` needs Freigabe.
+
+```bash
+bash /path/to/koopa-admin-log/scripts/notes/status.sh
+bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh
+# Freigabe:
+bash /path/to/koopa-admin-log/scripts/notes/cutover-to-silverbullet.sh --apply
+```
+
+See `scripts/notes/README.md` for seed + Caddy order. DNS: `silverbullet.hacktivism.ch`.
+
+## Build + recreate (koopa)
+
+```bash
+# clone koopa-admin-log from Forgejo when needed (no permanent ~/ clone)
+bash /path/to/koopa-admin-log/scripts/notes/build.sh
+cd ~/koopa-silverbullet
+podman-compose down
+podman-compose up -d
+bash /path/to/koopa-admin-log/scripts/notes/up.sh
+```
+
+## Caddy apply (sudo on koopa)
+
+```bash
+sudo bash /path/to/koopa-admin-log/scripts/caddy/merge-notes-site.sh
+# seed from secrets-enc SoT so apply does not rotate PASS
+sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
+  bash /path/to/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh
+```
+
+Runtime: `/etc/caddy/secrets/silverbullet-basicauth.txt` (root-only). Never recreate `~/koopa-secrets`.
+
+## Space SoT (Forgejo)
+
+Private `hernani/freenotes` — live tree `~/koopa-silverbullet/space/` (git). On-koopa push uses oneshot HTTP token (no hernani SSH key in `~/.ssh`); laptop push via `git@git.hacktivism.ch:hernani/freenotes.git` (ProxyJump).
+
+## Client apps (hosts)
+
+Notes-like **system apps** (standalone Brave/Chrome `--app=` window + own profile): `configs/notes/client-apps/`.
+
+- magikoopa: `~/Applications/SilverBullet.app` — `bash client-apps/install-magikoopa.sh`
+- clementine (on-box): `silverbullet.desktop` — `bash client-apps/install-clementine.sh`
+- optional: browser **Install app** (PWA) for Dock identity
+
+## Plugs (SB)
+
+`space/_plug/`: `treeview.plug.js`, `silversearch.plug.js` — see `PLUGS.md`.