chore: purge retired git.tx1138.com registry host from the codebase

The tx1138 Gitea was retired as a release server 2026-06-13 and its registry
frontend is fully dead (500 on every /v2 manifest read, observed 2026-07-10).
Nothing may reference it anymore:

- registry.rs: no longer a default registry, no longer force-enabled on
  load; saved configs are stripped of it on load (same one-time migration
  treatment as the decommissioned Hetzner mirror), with a regression test.
- image_policy.rs: removed from TRUSTED_REGISTRIES — refs through the dead
  host are now refused at the pull site (rejection test added).
- api/handler: dropped the legacy catalog-proxy fallback URL.
- .gitmodules: indeedhub submodule repointed to the OVH Gitea.
- scripts, image-recipe, app-catalog data, neode-ui strings, docs, and all
  test fixtures repointed to 146.59.87.168:3000 (or neutral example hosts).
- image-versions.sh: ARCHY_REGISTRY_FALLBACK emptied (guarded consumers
  skip it); reconcile-containers.sh candidate guard hardened.

The only remaining occurrences of the host string are the strip/reject
enforcement paths and their regression tests — the code that guarantees it
is never used again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -304,7 +304,7 @@ media (latest artifact only one minor behind).
 - [ ] 🟠 **Sign + checksum the ISO.** Pipeline ends at `xorriso` with no `SHA256SUMS`, no
       GPG/minisign, no Secure Boot (`BOOTX64.EFI` is unsigned though `grub-efi-amd64-signed` is
       installed). Emit + sign checksums; wire signed Secure Boot.
-- [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000` / `git.tx1138.com`
+- [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000`
       are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.)
 - [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 +
       mesh/WG). Neither exists today; OS packages drift until reflash and there is no host

docs/container-architecture.html

@@ -842,7 +842,7 @@
         </ul>
         <h4>Registry</h4>
         <ul>
-          <li>Private registry at <code>git.tx1138.com/lfg2025/</code></li>
+          <li>Private registry at <code>146.59.87.168:3000/lfg2025/</code></li>
           <li>HTTPS (self-hosted Gitea)</li>
           <li>All images pre-pulled into registry; nodes pull on first boot</li>
         </ul>

docs/dht-distribution-design.md

@@ -65,7 +65,7 @@ origin":
 
 ### IndeeHub (the streaming target)
 - Original platform (not a fork). Working source: `~/Projects/Indeedhub Prototype/`
-  (Vue 3 + NestJS). Submodule `git.tx1138.com/lfg2025/indeehub.git` (host retired —
+  (Vue 3 + NestJS). Submodule `146.59.87.168:3000/lfg2025/indeehub.git` (repointed off the retired host —
   needs a live remote). In `archy`: image-only, `apps/indeedhub/manifest.yml` pulls
   `146.59.87.168:3000/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis,
   minio, nostr-rs-relay).