the name: Bikoret — code, contracts, images

Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret`
object and the "— bikoret …" fringe on a gate reply; environment
variables BIKORET_*; the image user and paths (/home/bikoret,
/tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets,
/opt/bikoret/spec); the tmp-bikoret pod volume; local databases
bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and
the domain are unchanged (Tamid §1.1, "the names that still carry the
old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295,
Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL
redirects).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/secrets.yaml

@@ -1,4 +1,4 @@
-# Shorashim Secrets — template only
+# Bikoret Secrets — template only
 # NEVER commit actual secret values to git.
 # Apply with: kubectl apply -f - after filling in values.
 #
@@ -52,7 +52,7 @@ stringData:
 #   import base64, json, subprocess, sys, urllib.parse
 #   avn = json.load(sys.stdin)["password"]
 #   app = subprocess.run(
-#       ["kubectl", "get", "secret", "shorashim-secrets", "-n", "shorashim",
+#       ["kubectl", "get", "secret", "shorashim-secrets", "-n", "bikoret",
 #        "-o", "jsonpath={.data.DATABASE_URL}"],
 #       capture_output=True, text=True, check=True).stdout
 #   u = urllib.parse.urlsplit(base64.b64decode(app).decode())
@@ -94,7 +94,7 @@ stringData:
 # shorashim-api-keys — who may enter the courtyard
 # ============================================================
 #
-# Mounted as the file /etc/shorashim/secrets/api_keys in vav-pipeline
+# Mounted as the file /etc/bikoret/secrets/api_keys in vav-pipeline
 # (Construction §4.6: a secret is a file). One key per line:
 #
 #   courtyard <key>     offerings and bedikot (/courtyard/*)