DuckDNS: Let's Encrypt bewusst fallen gelassen, Portfreigabe erledigt

deploy_challenge (DNS-01) scheiterte reproduzierbar am dig-Aufruf im
DuckDNS-Add-on-Container selbst, obwohl DuckDNS den TXT-Eintrag nachweislich
korrekt setzt und dieser ueberall sonst (PC, HA-SSH-Konsole) sofort sichtbar
war - Ursache innerhalb des Containers blieb trotz gruendlicher Diagnose
ungeklaert. Entscheidung: abschalten statt weiter debuggen, da HA ohnehin
nur ueber Tailscale erreichbar ist. DuckDNS selbst (IP-Update) laeuft
zuverlaessig weiter - das ist der fuer den FMM003-Pfad relevante Teil.

configuration.yaml's http:-Block bleibt deshalb dauerhaft auskommentiert.
Portfreigabe 8883 und FMM003-Datenversand sind bestaetigt erledigt.

AGENTS.md

@@ -203,8 +203,13 @@ capacitor/iframe/browser (`umgebung.ts`), types + entity table (`types.ts`), fac
       Remaining: upload root/client cert/key to the FMM003 Security tab — filenames must end in
       `.pem`/`.pem.crt`/`.pem.key` (Configurator rejects plain `.crt`/`.key`, content-agnostic check)
 - [x] Decide broker reachability for the vehicle — port-forward 8883 (not VPS bridge), decided
-      2026-08-11; DuckDNS hostname `datametric360.duckdns.org` set up, Dual-Stack confirmed on the
-      router (no DS-Lite blocker). Remaining: the port-forward itself on the Speedport Smart 4 Plus
+      2026-08-11; DuckDNS hostname `datametric360.duckdns.org` set up and reliably updating,
+      port-forward 8883 done on the Speedport Smart 4 Plus, FMM003 confirmed sending data. Let's
+      Encrypt for HA's own local UI deliberately dropped (`deploy_challenge` DNS-01 hook failed
+      reproducibly inside the DuckDNS add-on container specifically — root cause not found despite
+      thorough diagnosis; not worth pursuing since HA is Tailscale-only anyway, see
+      COMPANION_APP_ARCHITECTURE.md §5 item 2a for the full writeup). `configuration.yaml`'s
+      `http: ssl_certificate/ssl_key` block stays commented out permanently.
 - [ ] MQTT Client Type on the FMM003: "Custom server" (value 3, seen in Configurator help text) was
       not selectable in practice — use **"AWS IoT Custom"** pointed at the own broker instead
       (confirmed working by two independent community reports); verify once the device is live