One gate to the world: Shorashim and Gitea behind the shared ingress

Three NLBs became one (185.19.28.170, ingress-nginx).

Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923)
is replaced by an Ingress — a host-less catch-all (works by IP, no DNS)
plus a `shorashim.ch` rule ready for the A record; TLS deliberately not
requested until the name resolves. Sanhedrin-length proxy timeouts.

The watch behind the ingress (completes tablet 46): the TCP peer is now
the ingress controller, so Mishmar.peer/1 takes the caller from
X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod
network, configmap); from anyone else the header is the caller's own
claim and is ignored. The ingress Service was already
externalTrafficPolicy: Local with its health-check port open, so the
caller's address arrives without the security-group change the direct
route needed. Verified live: the 11th knock is 429, a forged X-Real-IP
is still 429, and in the same minute the old route (pod sees the node)
was a different subject.

Gitea: no name of its resolves, so it rides the controller's TCP
passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22
(ingress-tcp-services.yaml), on the two NodePorts the security group
already allowed. gitea-mcp now reaches Gitea over the cluster network
instead of out through an NLB and back.

Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842….
Elixir 539/0 (L3 on and off).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/gitea-mcp-deployment.yaml

@@ -3,8 +3,11 @@
 # Deploys the official Gitea MCP server (gitea.com/gitea/gitea-mcp)
 # in HTTP mode, exposing /mcp endpoint for Streamable HTTP transport.
 #
-# The MCP server connects to the Gitea backend at 185.19.29.94
-# using a Personal Access Token stored in gitea-mcp-secrets.
+# The MCP server connects to the Gitea backend over the cluster network
+# (gitea.temple-council.svc.cluster.local) using a Personal Access Token
+# stored in gitea-mcp-secrets. Until 2026-10-06 it went out to Gitea's
+# own NLB (185.19.29.94) and back in; that NLB is gone — Gitea is behind
+# the shared ingress now (ingress-tcp-services.yaml).
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -31,7 +34,7 @@ spec:
             - "-t"
             - "http"
             - "--host"
-            - "http://185.19.29.94"
+            - "http://gitea.temple-council.svc.cluster.local"
             - "--port"
             - "8080"
           env:
@@ -41,7 +44,7 @@ spec:
                   name: gitea-mcp-secrets
                   key: GITEA_TOKEN
             - name: GITEA_HOST
-              value: "http://185.19.29.94"
+              value: "http://gitea.temple-council.svc.cluster.local"
           ports:
             - containerPort: 8080
               name: http