update network doc

docs/network.md

@@ -86,6 +86,7 @@ Cloudflare; internal overrides are served by Technitium where noted.
 |---|---|---|---|---|
 | `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
 | `auth.ahmza.com` | Authentik identity provider | `authentik` | Yes — `letsencrypt-prod`, trusted certificate and browser login verified; Technitium routes LAN clients to `10.10.60.12`. For public traffic, NetBird terminates public TLS and proxies HTTP through its encrypted WireGuard overlay to Caddy on `ingress1`; Caddy then uses certificate-validated HTTPS with `auth.ahmza.com` as SNI and the HTTP `Host` when connecting to ingress-nginx at `10.10.60.12:443` | [`apps/authentik/values.yaml`](../apps/authentik/values.yaml) |
+| `blog.ahmza.com` | Hugo blog | `blog-ahmza-com` | Yes — `letsencrypt-prod`, certificate Ready; HTTPS through `10.10.60.12` verified with HTTP 200 and hostname validation. Public Caddy/NetBird cutover and LAN DNS changes are not yet verified | [`apps/blog-ahmza-com/ingress.yaml`](../apps/blog-ahmza-com/ingress.yaml) |
 | `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
 | `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) |
 | `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) |
@@ -94,16 +95,6 @@ Add a row here every time you point a new hostname at this cluster (see
 [`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in
 Cloudflare, not in this repo — this table is just the log of what's real.
 
-## Planned hostname migrations (not yet verified live)
-
-- `https://blog.ahmza.com` → the `blog` Service in `blog-ahmza-com`, through
-  the existing ingress-nginx address `https://10.10.60.12`. Defined in
-  [`apps/blog-ahmza-com/ingress.yaml`](../apps/blog-ahmza-com/ingress.yaml).
-  Uses `letsencrypt-prod`; verify certificate issuance and update internal
-  DNS/external Caddy routing before cutover. No new MetalLB address is allocated.
-  Move this entry into the live hostname table only after verification. See
-  [`docs/13-blog-gitops.md`](13-blog-gitops.md) for the migration checklist.
-
 ## Free in the pool
 
 Addresses from the range above that aren't spoken for yet. Update this