docs: record 1.7.30 community hardening and backups

AGENTS.md

@@ -1527,10 +1527,11 @@ session with **no other memory of this project**. So:
   Owner/`crew.pubkey` = the bot `f978…f0`, admins = `ADMIN_PUBKEYS` + bot. The
   page passes `canCreate={false}`: everyone (admins included) uses the normal
   "Ask to join" flow; the bot auto-approves. After joining, admins still get the
-  requests panel as a fallback. Links: `/community` and **`/c`** both redirect
-  into `/#/community` (the old `/c` → Cordn-web shortcut was retired 2026-10-29
-  because Cordn web stalls after NIP-42); `/cordn` remains the raw
-  `https://cordn.net/chat/<cordn1…>` reference for Staircase/Cordn clients.
+  requests panel as a fallback. Links: `/community`, **`/c`** and **`/cordn`** all redirect into
+  `/#/community` (the old Cordn-web shortcuts were retired 2026-10-29 because
+  Cordn web stalls after NIP-42). The raw `cordn1…` reference is still
+  copyable from Advanced for Staircase/Cordn clients; the external open link
+  was removed.
   Entry points: nav catalog/burger + About feedback card.
   - **Join UX (2026-10-29):** community-specific approval copy names the bot or
     admins, an admin pending-request banner links to the room's request panel,
@@ -1554,8 +1555,9 @@ session with **no other memory of this project**. So:
     `join_request_take_many`'s `consumed` list (the old bot left approved
     requests in the queue and retried "already in the group" forever), logs
     pending counts, and stops auto-approval at **250 members** /
-    **5 devices per pubkey** (`COMMUNITY_MAX_MEMBERS`,
-    `COMMUNITY_MAX_DEVICES_PER_PUBKEY`). The bot must be rebuilt with
+    **5 devices per pubkey**, and **30 approvals/hour**
+    (`COMMUNITY_MAX_MEMBERS`, `COMMUNITY_MAX_DEVICES_PER_PUBKEY`,
+    `COMMUNITY_MAX_APPROVALS_PER_HOUR`). The bot must be rebuilt with
     `scripts/build-community-bot.sh` and copied to
     `/opt/skatespots-community/community-bot.cjs` when this file changes —
     **`scripts/deploy-community-bot.sh`** does the build, remote backup,
@@ -1564,6 +1566,13 @@ session with **no other memory of this project**. So:
   - **Secrets/backup:** bot key in `~/.config/skatespots/community.env` (600)
     and the VPS env; state copy in
     `~/.config/skatespots/community-state.json` (600). Never commit/print either.
+    **Daily backup (2026-10-29):** `scripts/backup-community-state.sh` pulls the
+    live state, keeps 30 daily snapshots in `~/.backups/community`, and pushes
+    the directory to restic (tag `community-state`) when
+    `~/.config/skatespots/restic.env` exists. Installed by
+    `scripts/install-community-backup-timer.sh` as user timer
+    `skatespots-community-backup.timer` (04:17, Persistent). `ops-health.sh`
+    reports both the bot service and the timer.
   - **Copy:** `communityUi.*` (en/es + all 24; 100%); bot rows are labeled
     "Community bot" by pubkey, no profile event required.
 - **Cordn native devices/members/benchmark (2026-10-28):** a new device can
@@ -2579,6 +2588,12 @@ Rules:
       refresh the local 0600 state backup) and `ops-health.sh` now checks the
       remote `skatespots-community` service. APK sha256 `c6f82fb5…`, versionCode
       10729. Web forced live at `e02f2b4`.
+    - **1.7.30 (2026-10-29):** `/cordn` also redirects to the app; the external
+      Cordn open link is removed (copy-only). Approving a device now asks for
+      confirmation. Corrected the second-device hint (Link device or re-request
+      with the new device) and added the bot’s 30/hour approval brake plus daily
+      30-snapshot local/restic state backups. APK sha256 `51dfe67e…`, versionCode
+      10730. Web forced live at `bde3d2484`.
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**