docs: correct crafty 4.10.7 report — the 401 was operator-configured MFA, not an upgrade bug (no regression); real MC server on 25565 verified from LAN

CHANGELOG.md

@@ -12,15 +12,14 @@
 - **App-page guidance** (`.felhom.yml` first_steps + prerequisites): how to set the server port within
   25565–25575, how to connect on the LAN (manual IP:port — "scan for LAN" won't auto-list), and that
   internet access needs operator port-forwarding. (Static text — can't show the live LAN IP.)
-- **Live-verified on guest 9201:** 4.10.7 healthy; public URL 302; fresh deploy → admin login works (200);
-  port range reachable from a LAN host at the guest's bridged IP `192.168.0.121:25565`/`:25575` (negative
-  control: `:25600` closed).
-- **⚠ Upgrade caveat (in-place only):** an in-place 4.4.8→4.10.7 upgrade of an existing seeded install
-  **locked out the admin** — 4.10.7 treats any `totp_data` row as active 2FA (`len(totp_user)>0`), and the
-  old install carried an unconfigured TOTP secret, so password-only login returns 401 despite the correct
-  password (argon2 hash still verifies). **Fresh 4.10.7 deploys are clean** (0 TOTP rows, login works) —
-  the only existing install (the demo) was fresh-redeployed. Any future in-place upgrade of a pre-4.10
-  Crafty needs its unconfigured TOTP rows cleared (or the user logs in with a recovery code).
+- **Live-verified on guest 9201:** 4.10.7 healthy; public URL 302; the guest's bridged LAN IP
+  `192.168.0.121` reaches the real Crafty "test" server on `25565` (TCP OPEN + Minecraft SLP handshake
+  returns JSON status); `:25575` reachable, `:25600` closed (negative control). In-place upgrade preserved
+  the admin, the operator's configured MFA, and the test server.
+- **Correction (earlier draft was wrong):** an earlier note here claimed the upgrade "locked out the
+  admin (TOTP)." That was a misdiagnosis — the `totp_data` row + recovery codes were **operator-configured
+  MFA**, so the 401 on a password-only login was correct behaviour, NOT an upgrade bug. There is **no
+  upgrade regression**; the bump preserves data and MFA correctly.
 
 ## 2026-06-26 — crafty-controller: seed a felhom-generated admin password (replaces Crafty's ugly random one)
 - **crafty-controller**: instead of reading Crafty's auto-generated (long, symbol-laden) random admin