Gitea MCP connector: MCP OAuth mode on bikoret.ch

The claude.ai connector ran the OAuth flow against a server in
static-token mode, which has no OAuth endpoints: the login ended on a
404. The proper form is gitea-mcp's -oauth mode, where each user
authorizes with their own Gitea account; it needs both origins public
over HTTPS and Gitea's ROOT_URL to be that origin.

- gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS
- gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch
  (were a name that never resolved and a released NLB IP)
- gitea-mcp-deployment.yaml: -oauth -oauth-public-url
  https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token,
  probes on /healthz
- gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired)
- gitea-public-apply.sh / gitea-public-verify.sh: the operator's
  DNS-gated apply and read-only verification (also in ~/.local/bin)
- KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2
  app ("Claude", PKCE, claude.ai + Claude Code redirect URIs)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/gitea-ingress.yaml

@@ -0,0 +1,46 @@
+# Ingress for Gitea itself — public HTTPS at git.bikoret.ch
+#
+# Added 2026-10-19 so the Gitea MCP server can run in MCP OAuth mode:
+# claude.ai and Claude Code send the user to Gitea's own OAuth2
+# authorize page, which must be reachable over HTTPS at Gitea's ROOT_URL
+# (gitea-public-patch.yaml sets ROOT_URL = https://git.bikoret.ch/).
+#
+# Gitea lives in namespace temple-council (Service gitea, 80 → 3000).
+# The plain-HTTP TCP passthrough on :3000 and SSH on :22
+# (ingress-tcp-services.yaml) stay as they are; this adds a third door.
+#
+# Prerequisites:
+# 1. DNS: git.bikoret.ch → 185.19.28.170 (Infomaniak zone)
+# 2. ClusterIssuer letsencrypt-prod
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+  namespace: temple-council
+  labels:
+    app.kubernetes.io/name: gitea
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    # git push of large packs; Gitea enforces its own limits
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - git.bikoret.ch
+      secretName: gitea-bikoret-tls
+  rules:
+    - host: git.bikoret.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea
+                port:
+                  number: 80