chore(sync): reconcile with production deploy tree — features, docs, plans gitignored

Bring main up to date with the live UKMesh production tree, reconciled
per-file (tree-wins for deployed features; main-wins where main evolved
past the tree's lineage; hand-merges for mixed files). Verified locally
on the deploy host: backend + frontend typechecks, backend unit suite
(543 pass / 0 fail), frontend suite (147 pass / 0 fail), OpenAPI
contract check, frontend production build, scripts typecheck.

Highlights:
- Deployed features land: tags + recent tags, owner public feed,
  Viterbi path prewarm and prior rebuilds, region participation,
  owner packet-sharing JWT scope, pathing docs, README updates.
- Main-side hardening retained: CI RAM steps + smoke cleanup trap,
  hardened scripts, gitleaks/logging rules, stale-MQTT observer
  protections, alert-receiver queue module, health-status refactor
  with tree retention additions (owner_packet_share_deliveries +
  public_feed_deliveries @30d, node_status_samples @30d — matching
  live TimescaleDB policies).
- Credential-generation client close restored on the tree's ownerAccess
  so the operator revocation tool (owner-auth:revoke) keeps working.
- Migrations renumbered to follow main's 058/059 ledger migrations:
  055_public_feed, 060_region_scope_participation,
  061_packet_share_owner_scope_and_jwt; migration-registry test
  assertions updated to the final numbering.
- Planning/report artifacts removed from the repo; local plans/, *.bak*
  patterns gitignored (deploy tree tidied to match).

docs/decryption.md

@@ -6,20 +6,16 @@ how historical traffic was retroactively decrypted.
 ## Key store
 
 - `backend/src/mqtt/channelRegistry.ts` is the single source of truth:
-  - `PUBLIC_CHANNELS` — 41 recovered/community-known values intentionally
-    classified as public and baked into the image. Each was validated against
-    real human-readable UK Mesh group text.
+  - `VALIDATED_CHANNELS` — default secrets baked into the image (39 entries
+    incl. Public; recovered 2026-08-06 and validated to decrypt real
+    human-readable group text).
   - `buildCombinedKeyStore()` — merges baked defaults with
-    `MESHCORE_CHANNEL_SECRETS` (managed environment configuration, with
-    comma-separated `name:hex` or bare hex entries; dedupes by secret).
-    Environment-supplied entries are classified as confidential; never commit
-    their values or copy them into `PUBLIC_CHANNELS`.
+    `MESHCORE_CHANNEL_SECRETS` (env, comma-separated `name:hex` or bare hex;
+    dedupes by secret) for secrets that shouldn't be committed.
   - `buildSummary()` / `identifyChannel()` — shared by ingest and offline
     tools.
-- The repo is **public**. `PUBLIC_CHANNELS` is the explicit source classification;
-  the scanner baseline in `.gitleaksignore` records exact historical
-  commit/path/rule/line fingerprints for reviewed public values, test fixtures,
-  and generated revision identifiers. New findings remain blocking by default.
+- ⚠️ The repo is **public**: keys in `channelRegistry.ts` are public. Keep
+  non-derivable/community keys in the env var only.
 - Reading env at startup only — after a change:
   `docker compose -f docker-compose.yml -f docker-compose.live.yml up -d --no-deps --force-recreate backend`.