tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)

SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo +
Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split.

Findings:
- 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin)
- 0 keys to revoke — никаких analyst / former employee / unknown keys
- 1 cosmetic cleanup: removed dead root authorized_keys entry (was
  duplicate of vitya's key, dead из-за `permitrootlogin no`)
- sshd hardening verified via `sshd -T` (effective config: root-no,
  password-no, kbd-no). **Gotcha** noted: raw grep of /etc/ssh/sshd_config
  shows defaults; sshd_config.d/ overrides делают effective. Future
  audits use `sshd -T`, not raw grep.
- fail2ban active, 2670 failed / 37 banned hist, currently 0
- last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP)

Acceptance per spec (Фаза 3, шаг 2 tenant-split):
✅ authorized_keys reviewed
✅ Non-core keys revoked (N/A — none existed)
✅ Analyst keys revoked (N/A — never issued)
✅ Documented in .wiki/concepts/books-ssh-access.md

Ingest: .wiki/concepts/books-ssh-access.md — retained keys table +
sshd state + fail2ban + login history + add/revoke processes +
cross-refs. Logged + indexed.

STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/ARCHIVE.md

@@ -814,3 +814,34 @@ Copy-Item C:\sites\snolla\Web.config.bak-pre-vds-cutover-20260522 C:\sites\snoll
 **Closes "Backup strategy для windows-host warm-standby"** — re-scoped из `cms-stopgap-backup-daily` (2026-05-21 spec) 2026-05-24 после migration MSSQL/sites + user-decision держать windows-host как DR fallback.
 
 **Branch:** master
+
+---
+
+## 🟢 [books-ssh-audit-shared-vds] — Closed 2026-05-24 — audit clean, 0 keys revoked + cosmetic dead-key cleanup
+
+**Closed:** 2026-05-24 — SSH audit на shared VDS (vds-kzntsv = 89.253.255.94 — где books Slovo+Bookva живут в shared compose-стеке) clean: 1 retained key (vitya core dev), 0 keys revoked, sshd hardening verified.
+
+**Audit findings:**
+- `/home/vitya/.ssh/authorized_keys` — 1 key (`ssh-ed25519 …ER/Z vitya@DESKTOP-NSEF0UK`)
+- `/root/.ssh/authorized_keys` — 1 dead duplicate key (root SSH disabled via `permitrootlogin no`), removed cosmetically (backup overwrite gotcha but trivially restorable from vitya's key)
+- 2 system users with shell — root + vitya (минимум)
+- `sshd -T` effective: `permitrootlogin no` + `passwordauthentication no` + `kbdinteractiveauthentication no` ✅
+- **Gotcha noted:** raw `/etc/ssh/sshd_config` grep показывал `PermitRootLogin yes` + `PasswordAuthentication yes` — defaults from package. Override'ы в `/etc/ssh/sshd_config.d/*.conf` make effective config. Future audits должны use `sshd -T`, not raw grep.
+- fail2ban active: 2670 failed / 37 banned historically, currently 0
+- journalctl `Accepted publickey` last 7 days — только `vitya from 94.19.247.14` (мой home public IP), no surprises
+
+**Acceptance check (per spec §Acceptance):**
+- ✅ `~/.ssh/authorized_keys` на shared VDS reviewed
+- ✅ Non-core keys revoked — N/A (only my key existed)
+- ✅ Analyst keys revoked — N/A (никогда не выдавались)
+- ✅ Documented in `OpeItcLoc03/admin/.wiki/concepts/books-ssh-access.md` (retained keys table + sshd state + fail2ban + login history + add/revoke processes + cross-refs)
+
+**Implications для tenant-split Phase 3 §SSH-аудит:** ✅ verified clean — на промежуточной стадии (1 VDS, 2 стека, 2 БД), хотя infra-level изоляция теоретически compromised (vitya с SSH мог бы прочитать обе БД через localhost), de-facto risk = nil. Single-developer setup, analyst access всегда был app-level only. Pre-cutover sigh of relief.
+
+**Atomic revert (если понадобится restore dead root key):** `ssh vitya@89.253.255.94 'echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKwYw1sS0Dj5FQmNxqJUV9IxU+9hZcg8qYQRgLN5ER/Z vitya@DESKTOP-NSEF0UK" | sudo tee /root/.ssh/authorized_keys'`. Key dead anyway (root SSH disabled), restoration cosmetic-only.
+
+**Detail:** `.tasks/books-ssh-audit-shared-vds.md` (per-task file with Decisions log + Completed steps).
+
+**Closes** Фаза 3, шаг 2 в `victor/books/.wiki/concepts/tenant-split.md`.
+
+**Branch:** master