Retire shorashim.ch; Gitea brand becomes Bikoret

- service.yaml: the shorashim.ch host rule is gone from the Ingress;
  the no-host catch-all stays for http://185.19.28.170
- gitea-public-patch.yaml: APP_NAME "Shorashim" → "Bikoret" (title and
  brand on every Gitea page)
- shorashim-ch-takedown.sh: the operator's apply (ingress, orphan
  mcp.shorashim.ch TLS secret, Gitea patch + rollout) with verification
- KOHEN.md, AGENTS.md: examples and the endpoint table use bikoret.ch

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/ARCHITECTURE.md

@@ -40,8 +40,9 @@ Kept in `deploy/k8s/`:
 - `gitea-mcp-ingress.yaml` — TLS ingress `mcp.bikoret.ch` for the MCP server
 - `gitea-mcp-secret.yaml` — template for a Gitea PAT (static-token mode only; kept for rollback)
 - `gitea-ingress.yaml` — TLS ingress `git.bikoret.ch` for Gitea itself (namespace temple-council), required by OAuth mode
-- `gitea-public-patch.yaml` — patch that sets Gitea's ROOT_URL/DOMAIN/SSH_DOMAIN to `git.bikoret.ch`
+- `gitea-public-patch.yaml` — patch that sets Gitea's ROOT_URL/DOMAIN/SSH_DOMAIN to `git.bikoret.ch` and APP_NAME to `Bikoret`
 - `gitea-public-apply.sh` / `gitea-public-verify.sh` — the operator's apply and read-only check for the four above
+- `shorashim-ch-takedown.sh` — 2026-10-20: removes the shorashim.ch ingress rule and the orphan mcp.shorashim.ch secret, applies the Gitea brand patch
 - `cert-manager-issuer.yaml` — Let's Encrypt ClusterIssuer
 
 ## Containers