chore: purge retired git.tx1138.com registry host from the codebase

The tx1138 Gitea was retired as a release server 2026-06-13 and its registry
frontend is fully dead (500 on every /v2 manifest read, observed 2026-07-10).
Nothing may reference it anymore:

- registry.rs: no longer a default registry, no longer force-enabled on
  load; saved configs are stripped of it on load (same one-time migration
  treatment as the decommissioned Hetzner mirror), with a regression test.
- image_policy.rs: removed from TRUSTED_REGISTRIES — refs through the dead
  host are now refused at the pull site (rejection test added).
- api/handler: dropped the legacy catalog-proxy fallback URL.
- .gitmodules: indeedhub submodule repointed to the OVH Gitea.
- scripts, image-recipe, app-catalog data, neode-ui strings, docs, and all
  test fixtures repointed to 146.59.87.168:3000 (or neutral example hosts).
- image-versions.sh: ARCHY_REGISTRY_FALLBACK emptied (guarded consumers
  skip it); reconcile-containers.sh candidate guard hardened.

The only remaining occurrences of the host string are the strip/reject
enforcement paths and their regression tests — the code that guarantees it
is never used again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/update.rs

@@ -2132,9 +2132,9 @@ mod tests {
     fn test_manifest_origin_parses_https() {
         assert_eq!(
             manifest_origin(
-                "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
+                "https://releases.example.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
             ),
-            Some("https://git.tx1138.com".to_string())
+            Some("https://releases.example.com".to_string())
         );
     }
 
@@ -2151,7 +2151,7 @@ mod tests {
     #[test]
     fn test_manifest_origin_rejects_garbage() {
         assert_eq!(manifest_origin("not a url"), None);
-        assert_eq!(manifest_origin("ftp://git.tx1138.com/x"), None);
+        assert_eq!(manifest_origin("ftp://releases.example.com/x"), None);
     }
 
     #[test]
@@ -2165,7 +2165,7 @@ mod tests {
                     name: "archipelago".into(),
                     current_version: "1.7.25-alpha".into(),
                     new_version: "1.7.26-alpha".into(),
-                    download_url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/archipelago".into(),
+                    download_url: "https://releases.example.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/archipelago".into(),
                     sha256: "x".into(),
                     size_bytes: 1,
                     blake3: None,
@@ -2174,7 +2174,7 @@ mod tests {
                     name: "frontend".into(),
                     current_version: "1.7.25-alpha".into(),
                     new_version: "1.7.26-alpha".into(),
-                    download_url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/frontend.tar.gz".into(),
+                    download_url: "https://releases.example.com/lfg2025/archy/raw/branch/main/releases/v1.7.26-alpha/frontend.tar.gz".into(),
                     sha256: "y".into(),
                     size_bytes: 2,
                     blake3: None,
@@ -2218,6 +2218,8 @@ mod tests {
                 label: "Server 1 (OVH)".to_string(),
             },
             UpdateMirror {
+                // Deliberately the retired host: this fixture exists to prove
+                // load_mirrors strips it.
                 url: "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
                     .to_string(),
                 label: "Server 2 (tx1138)".to_string(),
@@ -2406,7 +2408,7 @@ mod tests {
             rollback_available: false,
             schedule: UpdateSchedule::Manual,
             manifest_mirror: Some(
-                "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
+                "https://releases.example.com/lfg2025/archy/raw/branch/main/releases/manifest.json"
                     .to_string(),
             ),
             manifest_signed: false,