Note vpn dyndns migration confirmed live

FritzBox reconfigured with its dedicated per-host login; a real WAN IP
change after recycling the connection produced a genuine authenticated
update, confirmed in the access log and via dig. First device fully
migrated off the legacy shared-key fallback.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TODO.md

@@ -88,6 +88,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       Once `dyndns legacy shared-key update` stops appearing in `syslog`,
       remove the fallback `grant` and the `jens` account can be scoped down
       to just its own host too.
+      **`vpn` migrated 2026-07-26**: home FritzBox reconfigured with the
+      new `vpn` login and confirmed live — after a WAN IP change (real
+      connection recycle, not a test), the access log shows a genuine
+      `Fritz!Box DDNS/1.0.3` request authenticated as `vpn` updating
+      `vpn.dyndns.jayfield.org` to the new IP (`217.229.60.187`), and `dig`
+      confirms the zone picked it up. First host fully off the legacy
+      fallback. `kack`/`test`/`uschi` still need migrating.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.