доработки в файлах раскатки

codebase/backend/deployment/RUNBOOK.md

@@ -20,6 +20,15 @@ downgrade, or a mutable image tag during deployment.
 
 ## Gate 2 — VM hardening
 
+On a fresh Ubuntu 24.04 VM, run:
+
+```sh
+sudo deployment/scripts/setup-vm.sh
+```
+
+Before setting `HARDEN_SSH=true`, verify key-based access in a separate SSH
+session. The script header documents its parameters and safe defaults.
+
 - [ ] Ubuntu 24.04, NTP, unattended security updates and disk alerts are active.
 - [ ] Key-only deploy account works in a second session; root/password SSH is off.
 - [ ] UFW/cloud SG and `DOCKER-USER` policy survive reboot.