Add TODO markers, fill placeholders, mark stub pages (#1802)

* chore: add TODO markers for 12 files needing cfgcmd/opcmd conversion

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: fill TBD placeholder in flow-accounting, remove TBD in static routes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add stub admonitions to 3 minimal pages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: replace non-RFC IP addresses and suppress false positives in linter

Replace public IPs with RFC 5737 documentation addresses and add
stop/start_vyoslinter markers for false positives (MAC addresses,
OIDs, NAT64 well-known prefix).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: replace remaining non-RFC IPs and suppress MAC address false positive

- Replace 8.8.8.8 (Google DNS) with 192.0.2.1 (RFC 5737) in:
  - docs/configexamples/ansible.rst (3 occurrences)
  - docs/configexamples/nmp.rst (1 occurrence)
  - docs/automation/terraform/terraformvSphere.rst (1 occurrence)
- Wrap SHA-256 certificate fingerprint in openvpn-examples.rst with
  stop_vyoslinter/start_vyoslinter to suppress false-positive IPv6 flag

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: wrap long lines to comply with 80-char line length limit

Wrapped prose content exceeding 80 characters in 9 documentation files.
Only RST prose and directive content was modified; code block contents
were left untouched as they are exempt from the linter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: wrap 2 remaining long lines for linter compliance

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: suppress linter for long URL reference in terraformvSphere.rst

* fix: address Copilot review suggestions — broken links, typos, YAML indentation

- Fix broken inline RST links split across lines in sysctl.rst, eve-ng.rst,
  oracle.rst (stub notes with VyOS documentation repository link)
- Fix YAML indentation in both playbook code blocks in ansible.rst
- Fix typo "VyoS" -> "VyOS" in ansible.rst
- Fix typo "desition" -> "decision" in terraformvSphere.rst
- Fix 4 occurrences of "Terrafom" -> "Terraform" in terraformvSphere.rst
- Fix :doc: role split across two lines in openvpn-examples.rst
- Wrap long paragraph in openconnect.rst to <=80 chars and remove
  unnecessary stop/start_vyoslinter markers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: resolve remaining linter failures — long lines and OID false positive

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: revert 8.8.8.8 replacements, use stop_vyoslinter instead

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

3 files changed, 35 insertions, 8 deletions

diff --git a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
index fdeb347d..8494f0ea 100644
--- a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
@@ -4,6 +4,9 @@
 Troubleshooting Site-to-Site VPN IPsec
 ######################################
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 ************
 Introduction
 ************
@@ -286,8 +289,8 @@ The reason of this problem is showed on the responder side.
  Jun 23 08:16:12 charon-systemd[2440]: no acceptable proposal found
  Jun 23 08:16:12 charon[2440]: 01[IKE] <PEER|5> failed to establish CHILD_SA, keeping IKE_SA
 
-Encryption **AES_CBC_128** is configured in IKE policy on the responder but **AES_CBC_256**
-is configured on the initiator side.
+Encryption **AES_CBC_128** is configured in IKE policy on the
+responder but **AES_CBC_256** is configured on the initiator side.
 
 Prefixes in Policies Mismatch
 =============================
diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst
index 11824e50..d5c76e3e 100644
--- a/docs/configuration/vpn/openconnect.rst
+++ b/docs/configuration/vpn/openconnect.rst
@@ -4,6 +4,9 @@
 OpenConnect
 ###########
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 OpenConnect-compatible server feature has been available since Equuleus (1.3).
 Openconnect VPN supports SSL connection and offers full network access. SSL VPN
 network extension connects the end-user system to the corporate network with
@@ -81,9 +84,22 @@ For generating an OTP key in VyOS, you can use the CLI command
 User Certificate Authentication
 ===============================
 
-You can configure users to be authenticated by certificate by setting the authentication mode to certificate, and defining what field (by OID) in the certificate will be used to identify the username. Two pre-defined shortcuts for Common Name (OID 2.5.4.3) and User ID (OID 0.9.2342.19200300.100.1.1) have been provide as cn or uid. Otherwise a specific OID value must be provided.
+You can configure users to be authenticated by certificate by setting
+the authentication mode to certificate, and defining what field (by OID)
+in the certificate will be used to identify the username. Two pre-defined
+
+.. stop_vyoslinter
+
+shortcuts for Common Name (OID 2.5.4.3) and User ID
+(OID 0.9.2342.19200300.100.1.1) have been provided as cn or uid.
 
-The user's certificate must be signed by the certificate authority defined in the configuration for it to be validated for authentication.
+.. start_vyoslinter
+
+Otherwise a specific OID value must be provided.
+
+The user's certificate must be signed by the certificate authority
+defined in the configuration for it to be validated for
+authentication.
 
 .. code-block:: none
 
diff --git a/docs/configuration/vpn/rsa-keys.rst b/docs/configuration/vpn/rsa-keys.rst
index 0508522f..ce9aa720 100644
--- a/docs/configuration/vpn/rsa-keys.rst
+++ b/docs/configuration/vpn/rsa-keys.rst
@@ -2,6 +2,10 @@
 ########
 RSA-Keys
 ########
+
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 RSA can be used for services such as key exchanges and for encryption purposes.
 To make IPSec work with dynamic address on one/both sides, we will have to use
 RSA keys for authentication. They are very fast and easy to setup.
@@ -51,10 +55,14 @@ On the RIGHT:
 
 Now you are ready to setup IPsec. The key points:
 
-1. Since both routers do not know their effective public addresses, we set the local-address of the peer to "any".
-2. On the initiator, we set the peer address to its public address, but on the responder we only set the id.
-3. On the initiator, we need to set the remote-id option so that it can identify IKE traffic from the responder correctly.
-4. On the responder, we need to set the local id so that initiator can know who's talking to it for the point #3 to work.
+1. Since both routers do not know their effective public addresses,
+   we set the local-address of the peer to "any".
+2. On the initiator, we set the peer address to its public address,
+   but on the responder we only set the id.
+3. On the initiator, we need to set the remote-id option so that it
+   can identify IKE traffic from the responder correctly.
+4. On the responder, we need to set the local id so that initiator
+   can know who's talking to it for the point #3 to work.
 
 On the LEFT (static address):