ingress: bikoret.org redirect without $request_uri (admission webhook refuses it)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/service.yaml

@@ -121,7 +121,8 @@ metadata:
     app.kubernetes.io/name: shorashim
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch$request_uri
+    # The admission webhook refuses `$request_uri` in this annotation; the bare host is enough for a redirect domain.
+    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch
 spec:
   ingressClassName: nginx
   tls: