docs, comments: the drift the audit listed (audit 2026-10-17, stage 6)

The lines under "Doc and comment drift" that the findings' own commits
did not already fix:
- security.md: a newer confirmation link replaces the older, a reset link
  is not replaced; html/template renders every page (no themes); the
  container keeps eight capabilities, named, not "KILL".
- architecture.md: ImportKey writes over a name's key, as an import must;
  the error text reaches the browser on the Backup page's import refusal.
- guide: with Caddy the key is in Caddy's data, so a full backup refuses
  until certs/ holds a copy (or back up caddy-data).
- comments: sasldb2 holds application passwords in the clear (store,
  app/password.go); texthash folds ASCII (sender.go); the supervisor
  socket's group is supervisor (rpc.go); cert-reload's OpenSSL measurement
  was 3.0.x of bookworm; sendReset's limits (links.go).
Migration 0013's comment stays as shipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -407,6 +407,12 @@ docker compose -f docker-compose.yml -f caddy/docker-compose.caddy.yml up -d
 
 Verify Caddy's on-disk cert path for your version before relying on the
 default mount — see the comment at the top of the Caddy compose fragment.
+With Caddy the certificate lives in Caddy's own data, not in `certs/`, and
+Caddy writes its keys readable by itself alone: the panel's full backup then
+refuses with "certs/ holds no certificate". Back up `./caddy/caddy-data`
+with the project directory instead, or keep a copy of the pair in `certs/`,
+the key given to group 10997 (`chgrp 10997`, `chmod 640`), refreshed after
+each renewal.
 
 **Traefik (containerised).** Edit the `Host(...)` label and ACME email in
 [deploy/traefik/docker-compose.traefik.yml](../deploy/traefik/docker-compose.traefik.yml),