Confirm uschi dyndns migration live, note test-collision wrinkle

Real FritzBox update authenticated as uschi landed after a WAN IP
change, confirmed via dig. Documented the earlier test-value collision
where a verification write clobbered the device's first post-migration
update, resolved by its next natural IP change - no lasting impact,
but noted as a lesson for future verification steps.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TODO.md

@@ -154,6 +154,19 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       of any kind. The `jens` `.htpasswd` account itself was left in place
       (not asked to remove it, and it's now inert for DNS updates anyway
       since it has no hostname or grant left to use).
+      **`uschi` migration confirmed live 2026-07-26**: after the legacy
+      fallback was removed, a real WAN IP change (connection recycle, not
+      a test) produced a genuine `Fritz!Box DDNS/1.0.3` request
+      authenticated as `uschi` updating `uschi.dyndns.jayfield.org` to
+      `92.252.63.190`, confirmed via `dig`. (One wrinkle along the way: an
+      earlier verification test of mine — writing `uschi`'s old IP back
+      to confirm the fix — landed moments after that device's *first*
+      post-migration update and clobbered it back to the stale value; the
+      device's next natural IP change overwrote it correctly, so no
+      lasting effect, but a reminder to use non-colliding test values when
+      a real device might update concurrently.) Both `uschi` and `vpn` are
+      now fully migrated to dedicated per-host logins with no legacy
+      exceptions remaining anywhere in the setup.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.