deploy(labtools): 43e28ba LIVE on vds-kzntsv — cutover done, labtools.ru on VDS

DNS zone is on Yandex DNS (dns1/dns2.yandex.net), not reg.ru. Flip propagated
unevenly (dns2 first, dns1 lagged); cutover gate = BOTH authoritative Yandex NS
agree apex+www -> 89.253.255.94 (monitor waited for it) so LE HTTP-01 can't hit
RUVDS via a stale auth server and burn the rate-limit.

Stack 17 traefik-rule -> Host(labtools.ru)||Host(www.labtools.ru) via Portainer
PUT (env 8/8 preserved, pullImage=false). LE cert issued (~t+20s; brief self-signed
window during issuance). Live-smoke GREEN: both hosts 200 (nav+catalog+products),
redirects parity (trailing/lowercase/.php), sitemap index host=labtools.ru (this
tenant's siteUrl is non-www), theme assets byte-identical (RUVDS 301 apex->www made
the direct md5 an artifact; -L => MD5-OK). Staging host removed (->404). External:
apex->VDS 200; www still split-brain on RUVDS cache (200, identical content, TTL 6h).
RUVDS left intact as rollback.

Task closed. Whole batch done: labtools.ru + labtools.pro LIVE on VDS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

host-stacks/vds-kzntsv/labtools.compose.yml

@@ -44,8 +44,10 @@ services:
     labels:
       traefik.enable: "true"
       traefik.http.routers.labtools.entrypoints: websecure
-      # STAGING-хост. Боевой www.labtools.ru || labtools.ru добавить ТОЛЬКО на cutover-шаге.
-      traefik.http.routers.labtools.rule: Host(`labtools.vds.kzntsv.site`)
+      # CUTOVER 2026-07-02: DNS labtools.ru/www флипнут на VDS (89.253.255.94) оператором (Yandex DNS).
+      # Проверено ОБА авторитетных Yandex-NS (dns1+dns2) согласованно → 89.253.255.94 (НЕ labtools.pro!). Боевые хосты.
+      # staging-хост labtools.vds.kzntsv.site УБРАН post-cutover. RUVDS IIS 80.64.31.36 — rollback, не тронут.
+      traefik.http.routers.labtools.rule: Host(`labtools.ru`) || Host(`www.labtools.ru`)
       traefik.http.routers.labtools.tls.certresolver: letsEncrypt
       traefik.http.services.labtools.loadbalancer.server.port: "5000"