WP: Server hardening

[Polichinel]

Work Package: Server hardening

Deferred work package from the technical risk register. Not planned for current sprint — exists for visibility and future sprint planning.

Epic: #170

Concerns

• C-88 (Tier 2): SSH not restricted to PRIO/Uppsala IPs
• C-224 (Tier 4): No server backup or disaster recovery plan
• C-173 (Tier 4): Hetzner server memory headroom (CPX42 + swap)

Scope

Harden the Hetzner production server (views-datafactory-00). Restrict SSH access to known institutional IP ranges, establish a backup/DR plan for server state, and evaluate memory headroom under peak compilation loads. C-88 is the highest priority (Tier 2) as it represents an access control gap.