docs(plane): 自托管 Plane 落地事实入仓库 + plane-health runbook + hardening 草稿

记录源 Linear→Plane (2026-09-03 起, Plane MCP) + plane.chans.xyz 服务行/upstream 段;
inventory + hosts/synapse.chans.xyz.md 补 Plane 部署事实 (Helm plane-ce-1.8.0 / app v1.4.1,
ns plane, IngressRoute/自有证书 issuer/PVC 5+5Gi local-path/无备份层);
新增 runbooks/plane-health.md (只读健康检查) 与 docs/plane-hardening/ 草稿
(values.hardened.yaml、secrets.yaml.example 占位、backup/ CronJob), 均为未应用设计稿;
.gitignore 增加 .tmp-* agent 临时文件。

AGENTS.md

@@ -30,9 +30,12 @@ This repo is the **agent ops handbook + fact source** for maintaining personal V
    > read-only unless a change is approved).
 
 7. Record each material VPS operation, incident, configuration change, or
-   verification outcome in the corresponding **Linear `vps` project**. Include
-   scope, action, verification, and remaining follow-up; never put passwords,
-   tokens, private keys, recovery keys, or private room IDs in Linear.
+   verification outcome in the corresponding **Plane `vps` project**
+   (self-hosted `plane.chans.xyz`, Plane MCP `mcp__plane__*`). **Linear is
+   retired as a record source (2026-09-03) — do not create Linear issues;**
+   existing W1N-* entries are read-only history. Include scope, action,
+   verification, and remaining follow-up; never put passwords, tokens, private
+   keys, recovery keys, or private room IDs in Plane or Linear.
 
 ### Runbook execution rules
 
@@ -67,6 +70,7 @@ not maintain a second copy of the machine table here.
 | https://synapse.chans.xyz | synapse | Synapse Client-Server + Federation API |
 | https://account.chans.xyz | synapse | Matrix Authentication Service (local passwords) |
 | https://admin.chans.xyz | synapse | Element Admin console (MAS admin auth) |
+| https://plane.chans.xyz | synapse (`plane`, Helm `plane-ce` 1.8.0 / v1.4.1) | Plane project management (self-hosted, K3s) |
 
 ### Upstream docs
 
@@ -76,6 +80,8 @@ not maintain a second copy of the machine table here.
 
 **Matrix (ESS on synapse):** Matrix homeserver running on `synapse.chans.xyz` via the official ESS (Element Server Suite) Helm chart with Synapse + MAS + Element Web + Admin. DNS zone `chans.xyz` managed by hk2 PowerDNS. Before changing config, read [docs/matrix-upstream.md](docs/matrix-upstream.md) and [hosts/synapse.chans.xyz.md](hosts/synapse.chans.xyz.md). K3s cluster on this node has hostPort 80/443 for Traefik (no ServiceLB). Health: [matrix-health](runbooks/matrix-health.md).
 
+**Plane (on synapse):** Self-hosted Plane project management at `plane.chans.xyz`, Helm release `plane-app` (chart `plane-ce-1.8.0`, app `v1.4.1`) in ns `plane` on the same K3s node as Matrix. Config from `/home/windy/plane-k3s/values.yaml`; workload/cert/ingress details in [hosts/synapse.chans.xyz.md](hosts/synapse.chans.xyz.md). Its Postgres/MinIO PVCs are **not** backed up.
+
 **RustDesk:** Self-hosted RustDesk server on `hk2.chans.xyz` (`/opt/rustdesk`, containers `hbbs`/`hbbr`, image pinned `1.1.14`). The `hbbs -r` relay hostname must resolve to the host's public IP `154.36.174.161` — use `hk2.chans.xyz` (never `hk2.wsvc.info`, which has no DNS record). Health: [rustdesk-health](runbooks/rustdesk-health.md).
 
 ## Runbooks & scripts
@@ -91,6 +97,7 @@ not maintain a second copy of the machine table here.
 | PowerDNS health (hk2) | [runbooks/pdns-health.md](runbooks/pdns-health.md) |
 | PowerDNS upstream refs | [docs/pdns-upstream.md](docs/pdns-upstream.md) |
 | Matrix health | [runbooks/matrix-health.md](runbooks/matrix-health.md) |
+| Plane health | [runbooks/plane-health.md](runbooks/plane-health.md) |
 | RustDesk health (hk2) | [runbooks/rustdesk-health.md](runbooks/rustdesk-health.md) |
 | AdGuard Home health | [runbooks/adguard-home-health.md](runbooks/adguard-home-health.md) |
 | Home Assistant maintenance | [runbooks/home-assistant-maintenance.md](runbooks/home-assistant-maintenance.md) + [scripts/ha-maintenance.sh](runbooks/scripts/ha-maintenance.sh) |
@@ -116,7 +123,11 @@ Routine mailcow health: `cd ansible && ansible-playbook playbooks/health-report.
 
 ### Issue tracker
 
-Issues are tracked in Linear and created/updated via the Linear MCP (`vps` project). See `docs/agents/issue-tracker.md`.
+Issues are tracked in **Plane** — self-hosted at `plane.chans.xyz`, project
+`vps` — and created/updated via the Plane MCP (`mcp__plane__*`). **Linear is
+retired as a record source (2026-09-03); do not create Linear issues.** Existing
+W1N-* entries are read-only history. `docs/agents/issue-tracker.md` documents
+the retired Linear workflow and is stale; treat this section as authoritative.
 
 ### Triage labels