Security review: John's decisions on F41, F42 and F32

2FA turned off on the affected accounts until the F5/F41 fix; F42 key not
rotated now, moving it out of source is a later case; FastMail password
rotation after the old Sockeye server is retired.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devdocs/modernization/SECURITY-REVIEW.md

@@ -662,7 +662,8 @@ and their history (contrary to the "secrets never go in a repo" rule), and debug
 email through that account (which explains report 81's real bounces in testing). Fix: rotate that
 FastMail app password now (John); remove the values from both files and read debug SMTP settings
 from an environment variable or user secrets. History need not be rewritten once the password is
-rotated.
+rotated. **John, 2026-10-23:** rotation planned once the old Sockeye server is retired after the
+migration; its own case.
 
 OK in pass 8: SMTP settings change and the test-send route are OpsAdmin only; batch direct SMTP
 (`job-operations/batch-direct-smtp`) checks modify rights on the record type and sends only to the
@@ -770,7 +771,8 @@ and subscription servers; the business AyaNova server (8.2.x) has the same code.
 either has 2FA turned on, it can be reached with no password and a guessed code. **Immediate
 mitigation (no code change):** turn 2FA off on those accounts until the fix is deployed; with 2FA
 off the account is not matched by this query and the password protects it as usual. Then apply
-the F5 fix to Sockeye too. Other shared-code findings apply to Sockeye as well (F7, F8, F12, F19,
+the F5 fix to Sockeye too. **John, 2026-10-23: 2FA turned off** on the affected accounts; the fix goes
+in the same case as F5 (one commit per repo). Other shared-code findings apply to Sockeye as well (F7, F8, F12, F19,
 F21, F30; F1 if its config kept a placeholder); its admin UI is used by John alone, so only the
 anonymous ones (F5, F41) are urgent there.
 
@@ -786,6 +788,8 @@ environment variable on the Sockeye server only (root-readable, outside the repo
 published files) and remove it from the source. Rotation (new key pair, new public key in
 AyaNova, every licence reissued) is a business decision for John; without rotation the keys stay
 in history, so access to the repository and its backups must be treated as access to the keys.
+**John, 2026-10-23:** no rotation now; moving the key out of source becomes its own case for later
+(not an 8.3.0 blocker).
 
 ### F39 One-shot licence fetch by DB ID (pass 11, from code)