docs: Update tracking files for mailctl firewall & Nextcloud 31.0.14

- Nextcloud upgraded from 30.0.17 to 31.0.14
- mailctl firewall_setup now persists UCI rules for mail ports
- All apps updated (mail, tasks, external, spreed/Talk)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/HISTORY.md

@@ -2123,3 +2123,20 @@ git checkout HEAD -- index.html
 **Files Modified:**
 - `secubox-app-mailserver/files/usr/sbin/mailserverctl`
 - UCI firewall rules persisted for mail port forwarding
+
+### 2026-02-16: Mailctl Firewall & Nextcloud Upgrade
+
+**mailctl Firewall Rules Enhancement:**
+- Updated `cmd_firewall_setup()` to add UCI firewall rules for mail ports
+- Added input rules for WAN acceptance (ports 25, 143, 465, 587, 993)
+- Added forward rules for WAN-to-LAN mailserver forwarding
+- Rules now persist across firewall restarts via UCI config
+
+**Nextcloud Upgrade to 31.0.14:**
+- Upgraded from 30.0.17 → 31.0.14 using OCC updater
+- All apps updated (mail, tasks, external, spreed/Talk)
+- Database schema migrations completed successfully
+- System running with maintenance mode disabled
+
+**Files Modified:**
+- `secubox-app-mailserver/files/usr/sbin/mailctl` (cmd_firewall_setup function)

.claude/WIP.md

@@ -119,6 +119,17 @@ _Last updated: 2026-02-16 (DNS Master app, Mailserver KISS)_
   - Mozilla/Thunderbird format with IMAP (993/143) and SMTP (587/465)
   - HAProxy vhost and mitmproxy routes configured
 
+- **Nextcloud Upgrade 31.0.14** — DONE (2026-02-16)
+  - Upgraded from 30.0.17 → 31.0.14 via OCC updater
+  - All apps updated: mail, tasks, external, spreed/Talk
+  - Database schema migrations completed
+
+- **Mailctl Firewall Rules Persistence** — DONE (2026-02-16)
+  - Updated `cmd_firewall_setup()` with UCI firewall rules
+  - Input rules for WAN (ports 25, 143, 465, 587, 993)
+  - Forward rules for WAN-to-LAN mailserver
+  - Rules persist across firewall restarts
+
 ### Recently Completed (2026-02-15)
 
 - **HAProxy & Mitmproxy WAF Fixes** — DONE (2026-02-15)