docs(infra): app4 + core-bu provisioning, migration plan, verified inventory

- migration-plan-app4-core-bu-2026-09-15.md: 8-phase plan (Nuremberg decision,
  provider-diversity gap, acceptance criteria, rollback, DNS/Caddy checklist)
- core-service-inventory-2026-09-15: verified Core inventory, ~30 customer-facing
  services (the Aug 15 plan listed 5), 3 DocuSeal instances, TimeTrex Postgres,
  dead Caddy routes
- reference-update-matrix-2026-09-15: 52 artifacts that name a host
- fix naming collision: 6 files called the Hetzner box core-bu, the name core-bu
  now claims; app1-bu = 5.161.225.131, core-bu = 159.195.204.203 (netcup Nuremberg)
- correct the false provider-diversity claim (the standby is now netcup too)
- supersede app4-migration-plan.md (wrong region reported, silent on core-bu)

CHANGELOG.md

@@ -1,5 +1,17 @@
 # itpp-infrastructure — CHANGELOG
 
+## 2026-09-15 — app4 + core-bu Provisioned (Nuremberg)
+
+- **Renamed by Germaine (recorded at rename time per the changelog mandate):** the two netcup Nuremberg boxes ordered 2026-09-14 are now **app4** and **core-bu**.
+- **core-bu** = `v2202609377162521279.megasrv.de`, `159.195.204.203/22`, IPv6 `2a0a:4cc0:c2:b3e0:9409:42ff:fe3b:5397` — netcup **RS 2000 G12** (8 vCPU / 15 GB / 503 GB), exact twin of Core. Role: **Core's warm standby**.
+- **app4** = `v2202609377162521278.quicksrv.de`, `159.195.205.80/22`, IPv6 `2a0a:4cc0:c2:bcbf:34b3:8cff:fea2:2892` — netcup **RS 4000 G12** (12 vCPU / 32 GB / 1007 GB). Role: **Core's customer-facing services** (DocuSeal, TimeTrex, microbin, Uptime Kuma, Ops Portal backend, Postgres, Redis, customer Caddy routes).
+- **Location deviation recorded:** both boxes are in **Nuremberg (NBG)**, measured **100.5 ms RTT** from Core in Manassas (app2 Manassas = 0.5 ms, app1-bu Ashburn = 1.6 ms). The ITPP ordering standard specifies Manassas. Consequences and mitigations are in the migration plan; benefit is EU/US geographic separation between Core and its standby. **Provider diversity is still NOT met** (Core, app1-3, app4, core-bu, anita-mnz are all netcup); app1-bu (Hetzner) is the only other provider.
+- **Provisioned to standard:** Debian 13; `ippadmin` + NOPASSWD sudo; `itpp-infra` key for root and ippadmin; ufw active (22/80/443, plus 9100 from Core only); fail2ban; unattended-upgrades; 8 GB swap (9 GB on app4); Docker CE 29.8.0 + Compose v5.5.1; node_exporter; awscli + Wasabi credentials.
+- **sshd hardened to fleet convention:** `PermitRootLogin without-password`, `PasswordAuthentication no`, `AllowUsers ippadmin root`. Verified four ways per box (root key login, ippadmin key login + `sudo -n`, password auth refused, non-allowlisted user refused) with the self-reverting lockout guard armed during the change.
+- **Backups:** `root-essentials-backup.sh` + cron — app4 **04:45 ET**, core-bu **05:15 ET** → `s3://hermes-vps-backups/root-backup/{app4,core-bu}/`. First run on each tested end to end; script's own download+extract verify passed.
+- **Monitoring:** a `node_exporter` job was **added to the live Prometheus config** (`/root/docker/monitoring/prometheus/prometheus.yml`) — the job did not exist before. `up=1` verified for core, app4, core-bu.
+- **Pre-existing finding:** node_exporter is **not running** on app1, app2, app3 or app1-bu, and the node_exporter target list in `/opt/prometheus/prometheus.yml` sits in an **unmounted file that Prometheus never loaded** (it still names decommissioned `wphost02` and `178.156.131.57`). Host metrics for the existing fleet were therefore never collected; tracked as a follow-up, not fixed here.
+
 ## 2026-09-11 — Anita's Hermes Profile Moved to a Dedicated Box (anita-mnz)
 
 - **Infra move:** Anita's assistant profile moved off shared Core (`152.53.241.111`) to a dedicated box **anita-mnz `159.195.16.30`** (netcup, Manassas VA, 8 vCPU / 15 GB / 503 GB). Cutover 15:53 EDT, ~2 minutes dark, **zero messages lost**. She keeps the same Telegram bot and chat.