mission-control

38.1.1 Remove `startBluetoothDos/getBluetoothDosStatus/stopBluetoothDos` from GatewayApiClient; raise minSdk to 28; add BLUETOOTH_SCAN/BLUETOOTH_CONNECT to manifest

38.2.1 Add HidKeyReport.kt (USB HID descriptor + keycode map), BluetoothScanner.kt (startDiscovery + BroadcastReceiver), BluetoothHidManager.kt (BluetoothHidDevice profile), BtDeviceAdapter.kt (RecyclerView)

38.3.1 Rewrite BluetoothStressTestViewModel to use BluetoothScanner + BluetoothHidManager; update Activity with BT permission flow, device RecyclerView, AttackState handling

37.1.3 Update mc-proxy nginx to route mc.sunfeld.nl to k3s ingress instead of direct Docker port

36.3.1 Write k8s Deployment + Service manifest for mc stack (mc-nginx, mc-api, mc-redis) using existing Docker images; deploy to vouwai node via nodeSelector

37.1.1 Write k8s Deployment for mc-api, mc-client, mc-redis; mc-nginx as separate Deployment; ConfigMap for nginx config

36.3.2 Write Ingress resource routing `mc.sunfeld.nl` to mc-client Service; verify nginx ingress serves it internally

37.1.2 Write Service and Ingress for mc.sunfeld.nl routing through nginx ingress

36.1.1 Install k3s server on vouwai with `--disable traefik --disable servicelb --node-ip 100.74.12.9 --advertise-address 100.74.12.9 --tls-san 100.74.12.9`; save node token to `/var/lib/rancher/k3s/server/node-token`

36.1.2 Install nginx ingress controller via helm on vouwai k3s; expose ingress on Tailscale IP (100.74.12.9)

36.2.1 Install k3s agent on rektbox pointing to vouwai k3s API at `https://100.74.12.9:6443`; use node token from 36.1.1

36.2.2 Label nodes: vouwai as `role=storage`, rektbox as `role=compute`

35.1.1 Add `*.sunfeld.nl A 142.93.128.44` via `doctl compute domain records create sunfeld.nl --record-type A --record-name '*' --record-data 142.93.128.44 --record-ttl 300`; verify with `doctl compute domain records list sunfeld.nl`

35.2.1 Copy DO API credentials from vouwai `/etc/letsencrypt/digitalocean.ini` to mc-proxy; install `python3-certbot-nginx` and `python3-certbot-dns-digitalocean` on mc-proxy

35.2.2 Run `certbot certonly --dns-digitalocean --dns-digitalocean-credentials /etc/letsencrypt/digitalocean.ini -d "*.sunfeld.nl" -d "sunfeld.nl"` on mc-proxy; verify cert at `/etc/letsencrypt/live/sunfeld.nl/fullchain.pem`

35.3.1 Write `/etc/nginx/sites-available/sunfeld.nl` on mc-proxy with wildcard SSL cert and per-project server blocks: mc→100.74.12.9:9111, pefi→100.74.12.9:3000, fitness→100.74.12.9:9333; add default_server catch-all returning 444

35.3.2 Enable site, disable old mc.sunfeld.nl config, reload nginx on mc-proxy

35.3.3 Remove/disable old `pefi.sunfeld.nl` nginx config from vouwai host nginx (SSL no longer handled locally)

35.4.1 Verify mc.sunfeld.nl: `curl -sk --resolve mc.sunfeld.nl:443:142.93.128.44 https://mc.sunfeld.nl/mc/ -o /dev/null -w "%{http_code}"` → 200; cert CN = `*.sunfeld.nl`

35.4.2 Verify pefi.sunfeld.nl: same test → 200; cert CN = `*.sunfeld.nl`; no `ERR_CERT_COMMON_NAME_INVALID`