Retire shorashim.ch; Gitea brand becomes Bikoret

- service.yaml: the shorashim.ch host rule is gone from the Ingress;
  the no-host catch-all stays for http://185.19.28.170
- gitea-public-patch.yaml: APP_NAME "Shorashim" → "Bikoret" (title and
  brand on every Gitea page)
- shorashim-ch-takedown.sh: the operator's apply (ingress, orphan
  mcp.shorashim.ch TLS secret, Gitea patch + rollout) with verification
- KOHEN.md, AGENTS.md: examples and the endpoint table use bikoret.ch

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

AGENTS.md

@@ -105,7 +105,7 @@ approve decisions, or supervise work. The specification does all of this.
 | Service | Location | Access |
 |---------|----------|--------|
 | Gitea | `http://185.19.28.170:3000` (SSH :22) — behind the shared ingress NLB | User: heaviness510 |
-| Bikoret | `http://185.19.28.170` — behind the same ingress (catch-all; `shorashim.ch` once DNS points there) | keys: KOHEN.md "Issuing a key" |
+| Bikoret | `https://bikoret.ch` (also `http://185.19.28.170`, the catch-all; `shorashim.ch` retired 2026-10-20) | keys: KOHEN.md "Issuing a key" |
 | PostgreSQL | Exoscale DBaaS ch-gva-2 | `temple-council-db` |
 | Kubernetes | Exoscale SKS ch-gva-2 | `~/.kube/exoscale-temple-council.yaml` |