docs(guide): confirm firewall (OpenStack SGs) + SSH key-only posture (devops#17)

SGs are the firewall of record — public surface 80/443, SSH/Loki restricted to
internal+admin. All VMs key-only (passwordauthentication no) -> brute-force
mitigated, fail2ban optional. Dead SSH-ingress SG (22->world, unattached) to remove.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/main/resources/content/devops/security/overview.md

@@ -47,11 +47,18 @@ Daily health check (platform.production-checks §4) flags per-VM state; also rea
 > a hung guest. Core services were unaffected. Always `free -m` a VM before adding memory-heavy agents.
 > Tiny VMs (proxy) → agentless/remote scanning, not on-host clamscan.
 
-## Residual (re-scoped from #17)
+## Firewall & SSH — confirmed 2026-07-02 (#17)
 
-- No **`ufw`** (iptables is used directly via security-monitor; confirm OpenStack SG rules are the
-  network firewall of record and document them).
-- No **`fail2ban`** — but security-monitor covers *web* attack auto-blocking; **SSH brute-force**
-  specifically is the residual gap (SSH is key-only, which mitigates). → **hiveiq-devops#17** (re-scoped)
+**Firewall of record = OpenStack security groups** (host `ufw` is not the control and is not needed).
+Public (`0.0.0.0/0`) ingress surface:
+- `HTTPS ingress` SG → **443**
+- `hiveiq-services` SG → **80** + ICMP. SSH **22 restricted** to internal CIDRs (`10.10.10.0/24`,
+  `10.200.0.0/24` VPN) + one admin IP (`45.16.76.42/32`); Loki **3100** restricted to `10.10.10.0/24`.
+
+**SSH brute-force = mitigated.** All VMs: `passwordauthentication no` (key-only), root key-only. So
+password brute-force is impossible → **fail2ban is optional** (log-noise only, not a security gap).
+
+**Optional hygiene:** delete the dead **`SSH ingress` SG** (opens 22 to `0.0.0.0/0` but is attached to
+no server — latent risk); consider `permitrootlogin no`.
 
 See **platform.production-checks**, **devops.backups**, **platform.topology**.