Remove stale dyndns hosts kack and test instead of migrating them

Neither had shown real recent activity (kack not since Feb 2024, test
with no traffic in the per-vhost log's short history), so rather than
give them dedicated per-host logins like vpn/uschi, removed their DNS
records, TSIG keys, update-policy grants, and .htpasswd accounts
outright. Backed up before removal; jens/uschi/vpn unaffected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TODO.md

@@ -83,18 +83,36 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       pre-change records exactly.
       **Follow-up**: the `jens` legacy fallback (and its `.htpasswd`
       account) should stay only until every real device — including
-      whichever ones are still authenticating as `jens` to update `kack`/
+      whichever ones are still authenticating as `jens` to update `uschi`
-      `test`/`uschi` — has been reconfigured with its own dedicated login.
+      — has been reconfigured with its own dedicated login. Once `dyndns
-      Once `dyndns legacy shared-key update` stops appearing in `syslog`,
+      legacy shared-key update` stops appearing in `syslog`, remove the
-      remove the fallback `grant` and the `jens` account can be scoped down
+      fallback `grant` and the `jens` account can be scoped down to just
-      to just its own host too.
+      its own host too.
       **`vpn` migrated 2026-07-26**: home FritzBox reconfigured with the
       new `vpn` login and confirmed live — after a WAN IP change (real
       connection recycle, not a test), the access log shows a genuine
       `Fritz!Box DDNS/1.0.3` request authenticated as `vpn` updating
       `vpn.dyndns.jayfield.org` to the new IP (`217.229.60.187`), and `dig`
       confirms the zone picked it up. First host fully off the legacy
-      fallback. `kack`/`test`/`uschi` still need migrating.
+      fallback. `uschi`'s device was reconfigured too but hasn't sent a
+      real authenticated update yet (FritzBox only re-registers on WAN IP
+      change or manual renew, neither has happened since) — not yet
+      confirmed live.
+      **`kack`/`test` removed 2026-07-26** instead of migrated: `kack`
+      hadn't updated since Feb 2024 and `test` showed no real traffic in
+      the (short) per-vhost access log history either — both looked like
+      stale/unused entries rather than active devices, so removed outright
+      rather than given dedicated logins. Deleted their `A`/`AAAA`/`TXT`
+      records via `nsupdate` (using the legacy shared key), dropped their
+      `update-policy` grants and `include` lines from
+      `named.conf.default-zones`, moved their per-host TSIG key files and
+      `.htpasswd` entries (`htpasswd -D`) out. Backed up to
+      `/root/removed-configs-backup/dyndns-remove-kack-test-20260726101439/`.
+      Validated with `named-checkconf`/`apache2ctl configtest`, applied via
+      `rndc reload`/`systemctl reload apache2`, confirmed both names now
+      resolve to nothing (`dig` empty) and `jens`/`uschi`/`vpn` untouched;
+      `rndc sync` forced the on-disk zone file to reflect it immediately
+      rather than waiting for BIND's next periodic dump.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.