Fix accidental public-site lockout; document credential audit

A stray /var/www/html/.htaccess (dated 2025-02-18, predating everything
else in TODO.md) was silently requiring HTTP Basic Auth for jayfield.org
and www.jayfield.org's shared DocumentRoot, 401ing every real visitor to
the intentionally-public static site. Removed (backed up, not deleted).
Also adds a README table auditing which public hostnames do/don't
require credentials, prompted by checking this.

README.md

@@ -236,6 +236,20 @@ endpoint instead of a bespoke Apache-WebDAV + SFTP-upload pipeline:
   uses them anymore — reversible with `passwd -u` if SFTP is ever needed
   again.
 
+## Public access / authentication overview
+
+Audited 2026-07-20 — which public hostnames require credentials:
+
+| Host | Requires credentials? | Notes |
+|---|---|---|
+| `jayfield.org` / `www.jayfield.org` | No (intentionally public static site) | Was accidentally 401'ing every visitor via a stray `.htaccess` — fixed, see `TODO.md` |
+| `dyndns.jayfield.org` | Yes — HTTP Basic Auth | Vhost-level `<Directory>` block, intentional |
+| `mail.jayfield.org` | N/A — root is `403` (no content served there) | |
+| `mail.jayfield.org/rspamd` | Yes — rspamd's own login page | |
+| `cloud.jayfield.org` (Nextcloud) | Yes — redirects to `/login` | |
+| `portainer.jayfield.org` | Yes — admin account already initialized (`/api/users/admin/check` → `204`, no open setup wizard) | |
+| `web.jayfield.org` | No | Currently just the stock nginx welcome page (no real content deployed yet), so nothing sensitive is exposed — but worth revisiting before real content goes there if it's meant to stay public |
+
 ## Open items / known quirks
 
 - **Intranet migration from `vlda-01` (files, Gitea, Jellyfin, Dogecoin