f30e6aaa28
SGs are the firewall of record — public surface 80/443, SSH/Loki restricted to internal+admin. All VMs key-only (passwordauthentication no) -> brute-force mitigated, fail2ban optional. Dead SSH-ingress SG (22->world, unattached) to remove. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>