Merge remote-tracking branch 'origin/main' into feat/journal-post-form

# Conflicts:
#	user

docs/working/backlog.md

@@ -6,11 +6,12 @@ Ideas and improvements not yet planned or scheduled.
 
 ## Production — remaining items
 
-- [ ] Set `twig.cache: true` in `user/config/system.yaml` on the server (do not commit — breaks local dev)
+- [x] Prod Twig prod-mode (`cache: true`, `debug/auto_reload: false`) — applied as a per-environment override via `make remote-apply-env-prod` (source: `deploy/env/prod/system.yaml`); committed `system.yaml` stays dev
 - [ ] Smoke test: submit one post via `/post`, confirm entry appears in dailies immediately (verifies cache-on-save with twig cache on)
-- [ ] Confirm `/post` requires login — unauthenticated visitors must not be able to post
+- [x] Confirm `/post` requires login — verified on prod (returns the login gate to unauthenticated visitors)
 - [ ] Register at carto.com and review terms for production traffic
-- [ ] Japan & Korea 2026 trip page: set `date_start`, add `cover_image`, upload GPX route file(s)
+- [ ] Update `GRAV_VERSION` in `.env.prod` to `2.0.4` (was stale `2.0.0-rc.10`; fixed on the running server via self-upgrade, but a future fresh install would repeat the RC)
+- [ ] git-sync on prod: install, add encrypted token, apply `folders:` fix, enable after first content round-trip
 
 ---