Complete MariaDB 10.3->10.6 migration

Backed up all databases (mysqldump) and /etc/mysql before starting;
dry-run confirmed the exact expected package transition. Ran cleanly -
postinst auto-detected and upgraded the old datadir's system tables.
Verified end-to-end: vmail schema intact, doveadm lists both real
mailboxes correctly, and Postfix's MySQL lookups resolve against the
upgraded database. No Galera clustering was actually active, so the
galera-3->4 swap was a no-op in practice.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TODO.md

@@ -90,11 +90,24 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       task-timeout-tuning advisory, web UI reachable. Left `user@1001.service` (a per-login
       systemd session, not a real service) unrestarted since restarting it would disrupt the
       active login for no real benefit.
-      **Still open, deliberately deferred**: the actual `mariadb-server-10.3`→`10.6` major
-      version migration on the live mail-account database — needs its own careful pass
-      (backup, `mysql_upgrade`, compatibility check) rather than being folded into this
-      cleanup. The 22.04→24.04 release upgrade itself is also still pending, now that this
-      release is actually in a clean, consistent state to upgrade *from*.
+      **`mariadb-server-10.3`→`10.6` migration completed 2026-07-26**: took a full logical
+      backup first (`mysqldump --all-databases --routines --triggers --events
+      --single-transaction`, ~2MB, verified complete — all 4 databases including `vmail`
+      present, proper "Dump completed" footer) plus a tarball of `/etc/mysql`, to
+      `/root/db-backups/`. Confirmed via `apt install --dry-run mariadb-server` that the
+      transition was exactly as expected (remove `mariadb-server/client(-core)-10.3` +
+      `galera-3`, install the `-10.6`/`galera-4` equivalents, nothing else touched) before
+      running it for real. Went smoothly: package postinst detected the old 10.3 datadir and
+      ran the system-table upgrade automatically (confirmed via `mariadb-upgrade`: "already
+      upgraded to 10.6.23-MariaDB... no need to run mysql_upgrade again"). Verified end-to-end
+      afterward — `vmail` schema intact (1 domain, 2 accounts, 4 aliases, matching pre-upgrade
+      state), `doveadm user '*'` correctly lists both real mailboxes
+      (`jens@`/`otto2022@jayfield.org`), and Postfix's own MySQL lookups
+      (`postmap -q ... mysql:/etc/postfix/sql/{domains,accounts}.cf`) resolve correctly against
+      the upgraded database. No galera clustering was actually in use (just an unused compiled-in
+      dependency), so the `galera-3`→`4` swap needed no further action.
+      The 22.04→24.04 release upgrade itself is still pending, now that this release is
+      actually in a clean, consistent state to upgrade *from*.
 
 - [ ] **Mail server IP (`89.58.8.149`) listed on Barracuda's BRBL** — found
       2026-07-25 (user report: "jayfield.org is on the Barracuda MX