Fix accidental public-site lockout; document credential audit

A stray /var/www/html/.htaccess (dated 2025-02-18, predating everything
else in TODO.md) was silently requiring HTTP Basic Auth for jayfield.org
and www.jayfield.org's shared DocumentRoot, 401ing every real visitor to
the intentionally-public static site. Removed (backed up, not deleted).
Also adds a README table auditing which public hostnames do/don't
require credentials, prompted by checking this.

TODO.md

@@ -3,6 +3,27 @@
 Outstanding hardening items (see `README.md` for the full service overview).
 Nothing here is urgent; all are low-risk, no-downtime changes.
 
+- [x] **Public static site (`jayfield.org`/`www.jayfield.org`) was 401'ing every visitor** — done 2026-07-20
+      Found while auditing which services are reachable without credentials:
+      a stray `/var/www/html/.htaccess` (`AuthType Basic`, same
+      `AuthName "Restricted Content"`/`AuthUserFile /etc/apache2/.htpasswd`
+      as the intentional `dyndns.jayfield.org` protection) was silently
+      requiring login for the DocumentRoot both `jayfield.org` and
+      `www.jayfield.org` share — `/var/www` has `AllowOverride all`, so it
+      took effect with no vhost-level directive needed. File was dated
+      2025-02-18 (`index.html`/`apache.html` themselves are from 2022) —
+      predates every other change in this doc by well over a year, almost
+      certainly a forgotten leftover rather than intentional, and
+      contradicts `README.md`'s own description of both as a public static
+      site.
+      Fixed: moved to `/root/removed-configs-backup/htaccess-var-www-html.<timestamp>`
+      (recoverable, not deleted — same convention as this file's other
+      removed-config backups). No Apache reload needed (`.htaccess` is
+      read per-request). Verified both `jayfield.org` and
+      `www.jayfield.org` now return `200` with real page content;
+      `dyndns.jayfield.org`'s own (intentional, vhost-level) Basic Auth is
+      untouched and still returns `401` without credentials.
+
 - [x] **Lock down the dyndns TSIG key file permissions** — done 2026-07-19
       `/etc/bind/dyndns.jayfield.org.key` was `644` (world-readable), holding
       the shared secret that authenticates dynamic DNS updates for