test fixes and doc work

docs/SUBAGENT-DEVOPS-REFERENCE.md

@@ -1,5 +1,21 @@
 # DevOps Subagent Reference
 
+## Critical Rule: Server Access is READ-ONLY
+
+**Claude Code has READ-ONLY access to production/test servers.** The `claude-win10` user cannot execute write operations directly.
+
+When working with production/test servers:
+
+1. **Provide commands** for the user to execute (do not attempt SSH)
+2. **Wait for user** to report command output
+3. **Provide fix commands** 1-3 at a time (errors may cascade)
+4. **Verify success** with read-only commands after user executes fixes
+5. **Document findings** in relevant documentation
+
+Commands in this reference are for the **user to run on the server**, not for Claude to execute.
+
+---
+
 ## Critical Rule: Git Bash Path Conversion
 
 Git Bash on Windows auto-converts Unix paths, breaking container commands.
@@ -69,12 +85,11 @@ MSYS_NO_PATHCONV=1 podman exec -it flyer-crawler-dev psql -U postgres -d flyer_c
 
 ## PM2 Commands
 
-### Production Server (via SSH)
+### Production Server
+
+> **Note**: These commands are for the **user to execute on the server**. Claude Code provides commands but cannot run them directly. See [Server Access is READ-ONLY](#critical-rule-server-access-is-read-only) above.
 
 ```bash
-# SSH to server
-ssh root@projectium.com
-
 # List all apps
 pm2 list
 
@@ -210,9 +225,10 @@ INFO
 
 ### Production
 
+> **Note**: User executes these commands on the server.
+
 ```bash
-# Via SSH
-ssh root@projectium.com
+# Access Redis CLI
 redis-cli -a $REDIS_PASSWORD
 
 # Flush cache (use with caution)
@@ -278,10 +294,9 @@ Trigger `manual-db-backup.yml` from Gitea Actions UI.
 
 ### Manual Backup
 
-```bash
-# SSH to server
-ssh root@projectium.com
+> **Note**: User executes these commands on the server.
 
+```bash
 # Backup
 PGPASSWORD=$DB_PASSWORD pg_dump -h $DB_HOST -U $DB_USER $DB_NAME > backup_$(date +%Y%m%d).sql
 
@@ -301,8 +316,10 @@ MSYS_NO_PATHCONV=1 podman exec -e DATABASE_URL=postgresql://bugsink:bugsink_dev_
 
 ### Production Token Generation
 
+> **Note**: User executes this command on the server.
+
 ```bash
-ssh root@projectium.com "cd /opt/bugsink && bugsink-manage create_auth_token"
+cd /opt/bugsink && bugsink-manage create_auth_token
 ```
 
 ---