Gitea MCP connector: MCP OAuth mode on bikoret.ch

The claude.ai connector ran the OAuth flow against a server in
static-token mode, which has no OAuth endpoints: the login ended on a
404. The proper form is gitea-mcp's -oauth mode, where each user
authorizes with their own Gitea account; it needs both origins public
over HTTPS and Gitea's ROOT_URL to be that origin.

- gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS
- gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch
  (were a name that never resolved and a released NLB IP)
- gitea-mcp-deployment.yaml: -oauth -oauth-public-url
  https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token,
  probes on /healthz
- gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired)
- gitea-public-apply.sh / gitea-public-verify.sh: the operator's
  DNS-gated apply and read-only verification (also in ~/.local/bin)
- KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2
  app ("Claude", PKCE, claude.ai + Claude Code redirect URIs)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/gitea-mcp-secret.yaml

@@ -1,15 +1,21 @@
 # Gitea MCP Server — secrets template
 # NEVER commit actual values. Fill in and apply manually.
 #
-# Two secrets needed:
+# Since 2026-10-19 the MCP server runs in OAuth mode and uses NO static
+# token: users authorize with their own Gitea account. This secret is
+# kept only for a rollback to static-token mode (see the deployment).
+#
+# Two secrets needed (static-token mode):
 # 1. GITEA_TOKEN: Personal Access Token from Gitea
 #    Create at: http://185.19.28.170:3000/user/settings/applications
 #    Permissions: repo (read/write)
 #
 # 2. OAuth Client ID/Secret: Registered OAuth app in Gitea
 #    Create at: http://185.19.28.170:3000/user/settings/applications
-#    Redirect URI: https://claude.ai/api/mcp/auth_callback
-#    (These go into claude.ai connector settings, not this secret)
+#    Redirect URIs: https://claude.ai/api/mcp/auth_callback
+#                   http://127.0.0.1/callback   (Claude Code)
+#    Confidential Client: UNCHECKED (PKCE). Only the Client ID is needed;
+#    it goes into the claude.ai connector's Advanced settings, not here.
 ---
 apiVersion: v1
 kind: Secret