Beta 2026-08-14: record release candidate gates

[gin-melodic]

Summary

• pin API submodule to 2a163356eca1b5edb6b66a87a467aadeddf37dcb
• pin Web submodule to 6862ca2825b0b2da86760ada4a84507f46c47eaf
• record 82/82 Beta UAT PASS, defects, recovery checks, reconciliation and release status
• add the VPS Compose overlay and host Caddy configuration without replacing unrelated VPS services

Verification

• UAT-20260813-BETA-RC-01: 82 PASS, 0 FAIL, 0 Beta NOT RUN; 38 DEFERRED
• ALE raw security: 7/7 PASS
• local read-only reconciliation: 142 accounts, 62 transactions, 0 differences/issues
• API CI and Web CI: PASS
• VPS: five services healthy, five migrations, two RabbitMQ consumers and zero queued messages
• VPS recovery: RabbitMQ ready recovered in 14s; Redis in 0s; API in 1s
• VPS empty-database read-only reconciliation: PASS before and after recovery checks

Candidate images

• API: ghcr.io/gin-melodic/gaap-api@sha256:7e7546fef26de2da228c13b9db4658dddc1cf439d6b93e1773dcfc3ac75e5be8
• Web: ghcr.io/gin-melodic/gaap-web@sha256:4c3ef686d0085c854695f2fb1ba74a7b06010e641a888c4f362ed32c7191e3fc
• both OCI indexes contain a linux/amd64 manifest; VPS uses the digests, not latest

Related: gin-melodic/gaap-api#5 and gin-melodic/gaap-web#8.

NO-GO blockers

• the VPS Cloudflare token cannot access the gaap.cc zone; public apex still returns the old JSON 404 and www.gaap.cc is NXDOMAIN
• HTTPS/security headers, real Turnstile registration and public business smoke remain blocked on DNS access
• production backup/restore/schedule is explicitly deferred by the owner and remains a public-release blocker