Everything on, phase 2 completed: SecureMode on in production, checked by the deploy

Owner decision 2026-10-04: SecureMode on once the pasture passes with it.

- Both clean pasture passes were run over all six peers:
  - normally: 246 passed, 0 failed;
  - with Federation__SecureMode=true: every federation check passed. The only failures were four checks expecting an
    unsigned GET to get 404 or 410 where SecureMode answers 401. Those checks now go through `unserved` and
    `gone_unsigned` (lib/interop.sh), which expect 401 when SecureMode is on.
- Circle posts now reach their member on GoToSocial and Mastodon, and survive Mastodon's signed refetch, as does a
  followers-only post. The GoToSocial expected failure is gone.
- appsettings.Production.json turns SecureMode on.
- The deploy now checks that an unsigned GET of @thepra answers 401 and that a browser is redirected. It reads
  @thepra's discoverability through the Mastodon API, since the actor is no longer readable unsigned.
- docs/INTEROP.md (Mastodon, GoToSocial), CLAUDE.md and ROADMAP updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

docs/ROADMAP.md

@@ -31,9 +31,15 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
 
   Both open items were closed without a root step (owner decisions, 2026-10-04): the server fetches its geolocation
   databases itself, and the deploy makes and signs in as @thepra.
-- [ ] Everything on in production (owner decisions 2026-10-04): v1.18.0 self-updating geolocation, @thepra, the crawler
-  on, sign-up by invitation, one registrations switch; then signed audiences with circles for everyone and SecureMode on,
-  account privacy, and one answer everywhere (the mismatch sweep).
+- [ ] Everything on in production (owner decisions 2026-10-04):
+  - v1.18.0, deployed and verified 2026-10-04: geolocation that updates itself (DB-IP Lite 2026-10 loaded), the deploy
+    signing in as @thepra (undiscoverable), the crawler on (1010 servers known within the hour), sign-up by invitation
+    with one registrations switch;
+  - v1.19.0, 2026-10-04: circle posts reach Mastodon and GoToSocial members (each copy names and mentions its member),
+    followers-only, direct and circle posts served to signed refetches from those they were for, SecureMode on (all six
+    pasture peers pass under it), and account privacy (sign-in and recovery say nothing, recovery codes hashed for an
+    hour, a recovered password ends every session, a deleted root's personas and groups are deleted everywhere);
+  - still to come: one answer everywhere (the mismatch sweep).
 - [ ] P7 Threads, communities, moderation, the social graph
 - [ ] P8 Signatures, discovery, the long tail