recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer.
- Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders.
- Removed plans/ and planned-updates/ (deployment-planning docs) so no client/
  deployment domains appear in the public repo.
- All other secret stores were already gitignored.
- docs.coopcloud.tech retained as a submodule (public upstream).

.claude/commands/t1cc-stop.md

@@ -0,0 +1,70 @@
+---
+description: Destroy the t1cc DigitalOcean test server via terraform
+allowed-tools: [Bash, Read, Glob, Grep]
+---
+
+# t1cc-stop
+
+Destroy the t1cc DigitalOcean droplet using `terraform destroy`. The reserved IP is preserved — DNS stays pointed at it and the next `/t1cc-start` will reuse the same IP.
+
+Read and follow the instructions in `.claude/commands/includes/logging.md`.
+
+## Steps
+
+### 1. Check terraform state
+
+Verify there is something to destroy:
+```bash
+cd /workspace/terraform && terraform show -json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); rs=d.get('values',{}).get('root_module',{}).get('resources',[]); print('resources:', len(rs))"
+```
+
+If there are 0 resources, tell the user the server is already stopped (or was never started) and exit.
+
+### 2. Check .testenv
+
+Read `terraform/.testenv` and confirm `DO_TOKEN` is set. Terraform needs it to authenticate:
+```bash
+grep -q "DO_TOKEN=" terraform/.testenv && echo "token present" || echo "MISSING"
+```
+
+If missing, stop and tell the user to ensure `terraform/.testenv` contains `DO_TOKEN`.
+
+### 3. Destroy the droplet
+
+Run terraform destroy from the terraform directory:
+```bash
+cd /workspace/terraform && terraform destroy -auto-approve
+```
+
+This will:
+- Destroy the droplet
+- Remove the firewall
+- Remove the reserved IP **assignment** (but keep the reserved IP itself)
+
+Stream the output. This usually takes 1–2 minutes.
+
+### 4. Verify the droplet is gone
+
+After destroy completes, confirm no resources remain:
+```bash
+cd /workspace/terraform && terraform show
+```
+
+Expected output: `No state.` or empty state.
+
+Also verify via the DO API that the droplet is gone (optional but useful for confidence):
+```bash
+source terraform/.testenv && curl -s \
+  -H "Authorization: Bearer $DO_TOKEN" \
+  "https://api.digitalocean.com/v2/droplets?name=coopcloud-test" \
+  | python3 -c "import sys,json; d=json.load(sys.stdin); print('droplets:', len(d.get('droplets', [])))"
+```
+Expected: `droplets: 0`
+
+### 5. Report
+
+Print a summary:
+- Droplet destroyed: yes
+- Reserved IP preserved: show the IP from `terraform/.testenv` (RESERVED_IP)
+- DNS: unchanged — `t1cc.commoninternet.net` still points to the reserved IP
+- To restart: run `/t1cc-start`