docs: onboard AdGuard Home to Ansible; retire check-mx2; migrate plan to Linear

- Add dns.windy.lan to Ansible inventory (adguardhome group/profile) with a
  read-only healthcheck template, systemd timer, and on-demand report parity
  with the other active hosts; verified green on the host.
- Add synapse.chans.xyz to the AGENTS.md active-host quick map.
- Remove plans/; migrate decisions/verification to a Linear vps project doc and
  file the remaining gaps as W1N-46..49 with blocking edges.
- Retire scripts/check-mx2.sh; point mailcow health/update runbooks and the
  mx2 host file at the Ansible health report.
- Trim us2 stub software to verified running services; note dormant dirs.
- Normalize repo docs to English; drop the non-existent CONTEXT.md/ADR claim
  and remove docs/agents/domain.md.

runbooks/adguard-home-health.md

@@ -0,0 +1,60 @@
+# AdGuard Home health — dns.windy.lan
+
+This runbook is read-only.  It does not expose query-log contents or secrets.
+
+Routine checks run through Ansible on demand:
+
+```bash
+cd ansible
+ansible-playbook playbooks/health-report.yml --limit adguardhome
+```
+
+The same sanitized profile is installed as a daily server-local timer
+(`vps-healthcheck.timer`, output at `/var/lib/vps-health/latest.json`) via
+`playbooks/healthchecks.yml`; the manual checks below are for focused diagnosis.
+
+## Verify service and configuration
+
+```bash
+ssh -4 -o BatchMode=yes windy@192.168.66.36
+sudo docker ps --filter name=^/adguardhome$
+sudo docker exec adguardhome /opt/adguardhome/AdGuardHome --check-config \
+  -c /opt/adguardhome/conf/AdGuardHome.yaml
+sudo ss -lntup | grep -E '(:53|:80)'
+```
+
+Expected: DNS listens on TCP/UDP 53, and the HTTP UI listens only on
+`192.168.66.36:80`.
+
+## Verify DNS and storage
+
+```bash
+dig +time=5 +tries=1 @192.168.66.36 example.com A +noall +comments +answer
+dig +time=5 +tries=1 @192.168.66.36 example.com AAAA +noall +comments +answer
+dig +time=5 +tries=1 @192.168.66.36 hass.windy.lan A +noall +comments +answer
+sudo docker logs --since 30m adguardhome 2>&1 | grep -Ei '\[(error|warn|fatal)\]|level=(error|warn|fatal)' || true
+df -h /opt/adguardhome/work
+```
+
+The host intentionally accepts DNS from LAN55 and LAN66.  Do not infer a
+broken DNS policy merely because `allowed_clients` is empty.
+
+## Verify management UI boundary
+
+From LAN66, the UI should return a login redirect:
+
+```bash
+curl -sS -o /dev/null -w '%{http_code}\n' http://192.168.66.36/
+```
+
+From a LAN55 source, TCP/80 should time out or be refused by the dedicated
+`agh-ui-access.service` nftables rule.  Do not alter this rule to restrict
+port 53 without an explicit network-access review.
+
+## DNSSEC and PTR caveats
+
+DNSSEC is currently disabled.  Before enabling it, select upstreams that pass
+a known-bad-signature test; an enabled DO bit alone is not validation.
+
+Private PTR forwarding is intentionally absent because the EdgeRouter does
+not currently answer private PTR requests.

runbooks/mailcow-health.md

@@ -2,9 +2,10 @@
 
 Target: [mx2.windy.me](../hosts/mx2.windy.me.md)  
 Path: `/opt/mail`  
-Prefer: the Ansible health report (`ansible/playbooks/health-report.yml`), or
-`./scripts/check-mx2.sh` from this repo. The SSH commands below remain useful
-for focused, interactive diagnosis after the report identifies a problem.
+Prefer: the Ansible health report (`ansible/playbooks/health-report.yml --limit mailcow`),
+or the server-local daily timer result at `/var/lib/vps-health/latest.json`. The
+SSH commands below remain useful for focused, interactive diagnosis after the
+report identifies a problem.
 
 ## Focused SSH diagnostics
 
@@ -66,7 +67,9 @@ dig @1.1.1.1 +short windy.me TXT | grep -i spf
 
 ## Scheduled local check
 
-The sanitized Ansible health profile is `mailcow` (`ansible/playbooks/healthchecks.yml`). It preserves the existing standalone `scripts/check-mx2.sh` as the richer operator check, while the server-local timer emits a sanitized result at `/var/lib/vps-health/latest.json`. Neither check changes Mailcow configuration or service state.
+The sanitized Ansible health profile is `mailcow` (`ansible/playbooks/healthchecks.yml`).
+The server-local timer emits a sanitized result at `/var/lib/vps-health/latest.json`.
+It does not change Mailcow configuration or service state.
 
 ## Pass criteria
 

runbooks/mailcow-update.md

@@ -6,7 +6,7 @@ Path: `/opt/mail`
 
 ## Before
 
-1. Run [mailcow-health](mailcow-health.md) (or `./scripts/check-mx2.sh`). Record baseline.
+1. Run [mailcow-health](mailcow-health.md) (Ansible health report). Record baseline.
 2. Note config quirks in `mailcow.conf`, especially:
    - `SKIP_CLAMD=y` — after update, `clamd` may still be running until services are recreated per mailcow docs.
    - `SKIP_LETS_ENCRYPT`, ports, hostname — should stay `mx2.windy.me`.