Закрыли часть проблем с безопасностью + мелкие починки

codebase/backend/deployment/RUNBOOK.md

@@ -26,8 +26,10 @@ On a fresh Ubuntu 24.04 VM, run:
 sudo deployment/scripts/setup-vm.sh
 ```
 
-Before setting `HARDEN_SSH=true`, verify key-based access in a separate SSH
-session. The script header documents its parameters and safe defaults.
+The script disables password SSH and X11 forwarding by default, then locks the
+local `root` and `deploy` passwords after checking authorized keys. Before
+setting `HARDEN_SSH=true`, which also disables root login and TCP forwarding,
+verify key-based deploy access in a separate SSH session.
 
 - [ ] Ubuntu 24.04, NTP, unattended security updates and disk alerts are active.
 - [ ] Key-only deploy account works in a second session; root/password SSH is off.