Old ~/.config/credentials deleted on the operator's go (R-1134 closed); R-1130 accepted; R-1138 for its two backup copies (176 rows)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/runbooks/total-loss-of-dooplex.md

@@ -47,7 +47,7 @@ local restic repos; Prometheus history; DooPlex's other homelab apps (not Felhom
 | S13 | Domain registrar(s) for `felhom.eu`, `dooplex.hu`; No-IP (`dooplex.hopto.org`, the home address CNAME) | moving DNS / the home address | the operator; Vaultwarden | — |
 | S14 | Resend account / API key | all mail | Secrets export (S1+S5); Vaultwarden; the Resend dashboard (re-mint) | no — re-mint at Resend |
 | S15 | Gitea admin password; registry credentials (`gitea-creds`) | Gitea UI; image push/pull | the restored Gitea DB (password hash) + Vaultwarden; the Secrets export | no, after S1 (+S3) |
-| S16 | The hub operator password | the hub UI | the restored hub DB (hash); Vaultwarden — NOT `~/.config/credentials` any more (operator-only since 2026-10-15, `09` §3 decision 251; CC holds the scoped token `HUB_TOKEN` there instead, which a restored hub DB keeps as its hash) | no, after S2 (+S3) |
+| S16 | The hub operator password | the hub UI | the restored hub DB (hash); Vaultwarden — never in CC's store (operator-only since 2026-10-15, `09` §3 decision 251; CC holds the scoped token `HUB_TOKEN` in its secret store (S19) instead, which a restored hub DB keeps as its hash) | no, after S2 (+S3) |
 | S17 | Authentik admin | SSO for Vaultwarden and DooPlex apps | Authentik's DB (Longhorn on DooPlex, local PostgreSQL dumps only) | **yes** — not in any copy; Vaultwarden does not need it (password login) |
 | S18 | Households' recovery codes, PBS keys, restic passwords | households' restores | the households / escrow / the boxes | not the operator's |
 | S19 | **CC secrets age key** (`~/.config/sops/age/keys.txt` on DooPlex, 0600; public recipient `age1aw83ej37x9sck89xwt856ry0553kf5sng3w544an4et54yjdx5qq79utrv`) | opening `admin/cc-secrets` `store/cc.sops.yaml` — every secret CC uses (`sec`; `cc-secrets/ARCHITECTURE.md`) | DooPlex; Vaultwarden „CC secrets age key" (operator, 2026-10-17); the encrypted store itself is in Gitea (behind S1) | no, after S1 + S3 — unless also on the break-glass sheet |