wiki(lint): close all 10 lint issues + delete windows-host backup task

- deleted .tasks/windows-host-fallback-backup-daily.md (MSSQL removed on decommission 2026-06-08)
- recovery-architecture-snapshot.md: marked ИСТОРИЧЕСКАЯ ЗАПИСЬ; removed 3 broken [[wiki-links]] (cms-server-port-leak-fix, cms-admin-assets-root-folder-seed, webconfig-password-xml-escape)
- snolla-recovery-vm.md: marked УДАЛЕНА 2026-06-08
- ruvds-iis-host.md: struck 2 resolved risks (imgproxy SPOF, LE renewal); cross-ref winacme
- future-resilient-architecture-goals.md: dead task link → plain text
- mssql-on-vds.md: frontmatter fix; Backup TODO section replaced with implemented block (Express COPY_ONLY, sqlcmd, bind-mount pattern)
- vds-kzntsv.md: added MSSQL row to software stack table
- log.md: update entries for lint + mssql backup implementation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.wiki/concepts/mssql-on-vds.md

@@ -1,8 +1,9 @@
 ---
 title: MSSQL on vds-kzntsv (Express 2022 Linux)
-status: live
+type: concept
 tags: [vds, mssql, migration, ops]
-related: [[vds-kzntsv]], [[recovery-architecture-snapshot]], [[traefik-tcp-passthrough-vs-starttls]], [[db-tls-self-signed-via-traefik-raw-tcp]]
+related: [[../entities/vds-kzntsv]], [[recovery-architecture-snapshot]], [[traefik-tcp-passthrough-vs-starttls]], [[db-tls-self-signed-via-traefik-raw-tcp]]
+updated: 2026-05-22
 ---
 
 # MSSQL on vds-kzntsv
@@ -83,13 +84,22 @@ ALTER USER snolla WITH LOGIN = snolla;
 4. **`MSSQL_SA_PASSWORD` спец-символы**: rotation password generator должен excludeавать `+/=` (Base64) и shell-meta (`$`, `` ` ``, `"`, `'`, `\`). Иначе env-var passing через ssh heredoc или sed конструкторы ломаются. Пример безопасного: `[Convert]::ToBase64String($bytes) -replace '[+/=]','x'`.
 5. **MSSQL Linux user uid**: `mssql` user = uid 10001. Bind-mount должен быть `chown 10001:0` чтобы контейнер read/write. Parent dir owns `vitya:vitya` чтобы можно было редактировать compose без sudo.
 
-## Backup integration (TODO)
+## Backup integration
 
-Расширить `/opt/stacks/backup/scripts/run.sh` (см. [[vds-backup-rsync-kreknin]]):
-- `mssql_dump_full` daily — `BACKUP DATABASE [<db>] TO DISK='...' WITH COMPRESSION, COPY_ONLY` через `docker exec mssql sqlcmd ...`
-- `mssql_tx_log_backup` hourly — `BACKUP LOG [<db>] TO DISK='...'` для FULL-recovery DBs (только `MoreThenCms` — остальные SIMPLE).
-- Достигает target RPO 1ч (vs current daily snapshot).
-- ntfy push на `vds-backup` topic.
+Реализовано 2026-06-11 в `/opt/stacks/backup/scripts/run.sh` (см. [[vds-backup-rsync-kreknin]]). Блок между Step 1 (DB dumps) и Step 2 (rsync):
+
+```bash
+source /opt/stacks/databases/mssql/.env   # injects MSSQL_SA_PASSWORD
+for DB in MoreThenCms StayerCalculator StayerPrice TireService stostayer; do
+  docker exec mssql /opt/mssql-tools18/bin/sqlcmd \
+    -S localhost -U sa -P "$MSSQL_SA_PASSWORD" -C -b \
+    -Q "BACKUP DATABASE [$DB] TO DISK='/var/opt/mssql/backups/${DB}.bak' WITH COPY_ONLY, INIT"
+  mv /opt/stacks/databases/mssql/backups/${DB}.bak "$DUMP_DIR/mssql-${DB}.bak"
+done
+unset MSSQL_SA_PASSWORD
+```
+
+**Gotcha:** Express Edition не поддерживает `WITH COMPRESSION` — только `COPY_ONLY, INIT`. .bak файлы создаются в bind-mount `/var/opt/mssql/backups/` (uid 10001:10001); root mv их в `$DUMP_DIR` для rsync на kreknin. 5 DBs ~ 486 MB uncompressed. sqlcmd path: `/opt/mssql-tools18/bin/sqlcmd`.
 
 ## Rollback recipe