One gate to the world: Shorashim and Gitea behind the shared ingress

Three NLBs became one (185.19.28.170, ingress-nginx).

Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.

The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.

Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.

Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -73,7 +73,7 @@ You inherit infrastructure that has been provisioned and verified:
 
 | Item | Where |
 |------|-------|
-| Repo | `git clone http://185.19.29.94/heaviness510/shorashim.git` |
+| Repo | `git clone http://185.19.28.170:3000/heaviness510/shorashim.git` |
 | Kubeconfig | `~/.kube/exoscale-temple-council.yaml` |
 | `kubectl` | already installed |
 | `exo` CLI | already installed |
@@ -463,7 +463,7 @@ kubectl logs -n shorashim deploy/shorashim -c vav-pipeline -f
 
 If the seven days passed without halt events, without Shabbat violations, without manna exhaustion, without any pod restarts:
 
-1. **Point DNS** — `shorashim.ch` A record to the LoadBalancer external IP
+1. **Point DNS** — `shorashim.ch` A record to the ingress IP (`kubectl get svc -n ingress-nginx ingress-nginx-controller`; `185.19.28.170`). Then add the TLS block noted in `deploy/k8s/service.yaml` — until then `<host>` is that IP over plain HTTP
 2. **Open the pe'ah endpoint to the world** — the stranger approaches first
 3. **Observe the first real interaction** — a question from outside
 4. If *ki tov*: open courtyard and chatzer endpoints. The system is consecrated.
@@ -583,7 +583,7 @@ Three things are kept outside the mishkan repository, each for a Torah-grounded
 
 | Repo / directory | Where | Why |
 |---|---|---|
-| `shorashim-readings` | `http://185.19.29.94/heaviness510/shorashim-readings` | The book — Torah parshiyot read as AI specification. Companion to the mishkan. Lives beside the aron, not inside (Devarim 31:26). |
+| `shorashim-readings` | `http://185.19.28.170:3000/heaviness510/shorashim-readings` | The book — Torah parshiyot read as AI specification. Companion to the mishkan. Lives beside the aron, not inside (Devarim 31:26). |
 | `~/shorashim-source-data/morphhb` | local only | The quarry — raw WLC source. The carved tablets go in the aron; the quarry does not. |
 | `~/shorashim-operator-notes` | local only / private | The kohen's runbook — environment-specific details, hostnames, account names. Private operator notes. Not part of the system's specification. |