Init repo infra + poprawki runbooka bootstrap i HANDOFF

- Krok 9 (tmux): tee -> tee -a (nie nadpisuj configu), dodano
  focus-events on, poprawiono nazwę sesji na "bootstrap"
- Krok 10: struktura katalogów odzwierciedla stan faktyczny
  (/srv i /srv/infra już istnieją, brakuje apps i data)
- Krok 12: Claude Code oznaczony jako wykonany 20-08-2026,
  instalator natywny bez Node.js
- Nowy Krok 14: audyt po bootstrapie (SSH, ufw, fail2ban,
  unattended-upgrades, swap, Docker, porty, klucze)
- HANDOFF.md: poprawiona numeracja sekcji 6

.claude/settings.json

@@ -0,0 +1,63 @@
+{
+  "permissions": {
+    "defaultMode": "auto",
+
+    "additionalDirectories": [
+      "/srv/apps",
+      "/srv/data"
+    ],
+
+    "ask": [
+      "Bash(rm -rf:*)",
+      "Bash(sudo rm:*)",
+      "Bash(sudo rm -rf:*)",
+
+      "Bash(docker volume rm:*)",
+      "Bash(docker volume prune:*)",
+      "Bash(docker system prune:*)",
+      "Bash(docker compose down -v:*)",
+
+      "Bash(sudo ufw:*)",
+      "Bash(sudo tee /etc/ssh:*)",
+      "Bash(sudo systemctl restart ssh:*)",
+      "Bash(sudo systemctl stop:*)",
+      "Bash(sudo systemctl disable:*)",
+      "Edit(/etc/ssh/**)",
+      "Write(/etc/ssh/**)",
+      "Edit(/etc/fail2ban/**)",
+      "Edit(/etc/sudoers*)",
+      "Write(/etc/sudoers*)",
+
+      "Bash(sudo reboot:*)",
+      "Bash(sudo shutdown:*)",
+      "Bash(sudo poweroff:*)",
+
+      "Bash(sudo adduser:*)",
+      "Bash(sudo useradd:*)",
+      "Bash(sudo deluser:*)",
+      "Bash(sudo usermod:*)",
+      "Bash(sudo passwd:*)",
+      "Edit(**/authorized_keys)",
+      "Write(**/authorized_keys)",
+
+      "Bash(dropdb:*)",
+      "Bash(psql:*)",
+      "Bash(mysql:*)",
+      "Bash(docker compose exec db:*)",
+
+      "Bash(git push --force:*)",
+      "Bash(git reset --hard:*)",
+      "Bash(git clean:*)"
+    ],
+
+    "deny": [
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/id_rsa*)",
+      "Read(**/id_ed25519*)",
+      "Read(**/acme.json)"
+    ]
+  }
+}