docs: CHANGELOG + REPORT for crafty 4.10.7 bump, port range, guidance; flag in-place-upgrade TOTP lockout

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2026-06-26 — crafty-controller: image bump 4.4.8→4.10.7 + publish Java port range + connection guidance
+- **Image bump** `crafty-4:4.4.8` → `4.10.7` (latest stable; 4.10.8/4.11.0 don't exist in the registry).
+  6 minor versions of fixes incl. security CVEs. **Java 25 verified present** in 4.10.7
+  (`/usr/lib/jvm/java-25-openjdk-amd64`, default `java -version` = openjdk 25.0.3; 8/11/17/21 also
+  available) — so the latest-Minecraft (`26.x`, needs Java 25) blocker is resolved. Healthcheck + Traefik
+  https-backend labels unchanged (Crafty still serves HTTPS on 8443).
+- **Published the Java game-port range** `25565-25575:25565-25575` (TCP, 11 ports = up to 11 Java
+  servers; first server 25565, rest 25566–25575). No `network_mode: host` (would break Traefik routing).
+  Bedrock UDP 19132 intentionally out of scope.
+- **App-page guidance** (`.felhom.yml` first_steps + prerequisites): how to set the server port within
+  25565–25575, how to connect on the LAN (manual IP:port — "scan for LAN" won't auto-list), and that
+  internet access needs operator port-forwarding. (Static text — can't show the live LAN IP.)
+- **Live-verified on guest 9201:** 4.10.7 healthy; public URL 302; fresh deploy → admin login works (200);
+  port range reachable from a LAN host at the guest's bridged IP `192.168.0.121:25565`/`:25575` (negative
+  control: `:25600` closed).
+- **⚠ Upgrade caveat (in-place only):** an in-place 4.4.8→4.10.7 upgrade of an existing seeded install
+  **locked out the admin** — 4.10.7 treats any `totp_data` row as active 2FA (`len(totp_user)>0`), and the
+  old install carried an unconfigured TOTP secret, so password-only login returns 401 despite the correct
+  password (argon2 hash still verifies). **Fresh 4.10.7 deploys are clean** (0 TOTP rows, login works) —
+  the only existing install (the demo) was fresh-redeployed. Any future in-place upgrade of a pre-4.10
+  Crafty needs its unconfigured TOTP rows cleared (or the user logs in with a recovery code).
+
 ## 2026-06-26 — crafty-controller: seed a felhom-generated admin password (replaces Crafty's ugly random one)
 - **crafty-controller**: instead of reading Crafty's auto-generated (long, symbol-laden) random admin
   password, we now **seed** a clean felhom-generated one — same pattern as gokapi, so initial passwords are