kb: batch from 2026-07-30 parallel run (#181 #183 #189 #192 #164 #128 #219)

Work produced by the /kb driver on 2026-07-30. Each change is recorded on its
Kanboard task; all remain Done-unverified or parked pending alvis's decisions.

#183 agap-mcp/src/gitea.js
  askpassScript() and giteaWikiWrite()'s wiki checkout both used
  /tmp/agap-mcp-wiki, so writing the askpass helper made the dir non-empty and
  git clone always failed. gitea_wiki_write had likely never succeeded in
  production. Askpass moved to its own dir.

#181 agap-mcp/src/server.js
  Initialise registeredToolCount at module load so /health reports the real
  count immediately instead of 0 until the first MCP request.

#189 kanboard/backup.sh, seafile/backup.sh, vaultwarden/backup.sh,
     users-backup.sh, openai/backup-{hindsight-adolf,llm-dbs}.sh
  Remove the dead *.ts Zabbix trapper pushes (never landed). users-backup.sh
  also pointed at localhost:81 instead of 192.168.1.4:81 and pushed a date
  string into a numeric item. Freshness monitoring now rides the .age items.

#192 RESTORE-RUNBOOK.md, {kanboard,seafile,vaultwarden}/restore.sh
  Restore path for the three services, verified in throwaway containers.
  Note: this work found Seafile backups have carried an empty ccnet_db.sql
  since 2026-07-07 -- filed as kb#222, not fixed here.

#164 openai/litellm-config.yaml
  Metered `judge` (anthropic/claude-haiku-4-5) entry removed per alvis's
  2026-07-30 decision. ANTHROPIC_API_KEY was never wired, so it could not spend.

#128 openai/agent_registry.py
  litellm_key_spec() now also grants the routing-mode aliases, gated by the
  same _reachable_tiers() check as raw grants, so a small-tier agent cannot
  acquire automatic routing that resolves to tier-large.

#219 openai/migrate-adolf-state.sh
  Migration script only; inert until run. Copies (never moves) the
  openai_adolf-state volume to /mnt/ssd/dbs/adolf, verifying a full sha256
  manifest before declaring success. Tested against a throwaway volume.

Deliberately NOT included, both awaiting alvis:
  agap-mcp/docker-compose.yml -- kb#174's contested BW_EMAIL revert (parked).
  openai/docker-compose.yml   -- kb#219's bind-mount switch; the target dirs
                                 under /mnt/ssd/dbs/adolf do not exist yet, so
                                 committing it would let a later `compose up`
                                 recreate Adolf against empty paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff

openai/backup-llm-dbs.sh

@@ -2,9 +2,9 @@
 # Backup script for litellm-db and langfuse-db (openai stack postgres containers).
 # litellm-db holds provisioned virtual keys + spend; langfuse-db holds all traces.
 # Mirrors the seafile/vaultwarden backup.sh pattern (same repo): dump via
-# `docker exec <container> pg_dump`, gzip, retention of last 5, Zabbix freshness
-# trapper item per DB. Uses pg_dump (safe against a live/running DB, no downtime
-# needed — unlike gitea's stop-the-world dump).
+# `docker exec <container> pg_dump`, gzip, retention of last 5. Uses pg_dump (safe
+# against a live/running DB, no downtime needed — unlike gitea's stop-the-world dump).
+# Backup-freshness monitored via .age items.
 #
 # Run every 3 days via root crontab (same schedule as vaultwarden/seafile), e.g.:
 #   0 3 */3 * * /home/alvis/agap_git/openai/backup-llm-dbs.sh >> /mnt/backups/openai-llm-dbs/backup.log 2>&1
@@ -21,42 +21,24 @@
 set -euo pipefail
 
 BACKUP_DIR="/mnt/backups/openai-llm-dbs"
-ZABBIX_TOKEN_FILE="/root/.zabbix_token"
-ZABBIX_URL="http://192.168.1.4:81/api_jsonrpc.php"
 
 DATE=$(date '+%Y%m%d-%H%M')
 DEST="$BACKUP_DIR/$DATE"
 
 mkdir -p "$DEST"
-
-notify_zabbix() {
-  local itemid="$1" label="$2"
-  if [[ -f "$ZABBIX_TOKEN_FILE" ]]; then
-    local token now_epoch
-    token=$(cat "$ZABBIX_TOKEN_FILE")
-    now_epoch=$(date '+%s')
-    env -u HTTPS_PROXY -u HTTP_PROXY -u ALL_PROXY -u https_proxy -u http_proxy -u all_proxy \
-      curl -s -X POST "$ZABBIX_URL" \
-      -H "Content-Type: application/json" \
-      -H "Authorization: Bearer $token" \
-      -d "{\"jsonrpc\":\"2.0\",\"method\":\"history.push\",\"id\":1,\"params\":{\"itemid\":\"$itemid\",\"value\":$now_epoch}}" > /dev/null \
-      && echo "Zabbix notified ($label=$now_epoch)."
-  else
-    echo "WARNING: $ZABBIX_TOKEN_FILE not found -- skipped Zabbix freshness push for $label." >&2
-  fi
-}
+# Backup-freshness monitoring is now done via .age items (calculated fields showing
+# age of the backup). The .ts (timestamp) trappers were unreliable (history.push not
+# landing); removed in kb#189 in favor of .age overdue triggers.
 
 # --- litellm-db ---
 echo "Dumping litellm-db..."
 docker exec litellm-db pg_dump -U litellm litellm | gzip > "$DEST/litellm-db.sql.gz"
 echo "Dumped: litellm-db -> $DEST/litellm-db.sql.gz"
-notify_zabbix "70637" "litellm.db.backup.ts"
 
 # --- langfuse-db ---
 echo "Dumping langfuse-db..."
 docker exec langfuse-db pg_dump -U langfuse langfuse | gzip > "$DEST/langfuse-db.sql.gz"
 echo "Dumped: langfuse-db -> $DEST/langfuse-db.sql.gz"
-notify_zabbix "70638" "langfuse.db.backup.ts"
 
 echo "$(date): Backup complete: $DEST"
 ls -la "$DEST/"