chore: purge retired git.tx1138.com registry host from the codebase

The tx1138 Gitea was retired as a release server 2026-06-13 and its registry
frontend is fully dead (500 on every /v2 manifest read, observed 2026-07-10).
Nothing may reference it anymore:

- registry.rs: no longer a default registry, no longer force-enabled on
  load; saved configs are stripped of it on load (same one-time migration
  treatment as the decommissioned Hetzner mirror), with a regression test.
- image_policy.rs: removed from TRUSTED_REGISTRIES — refs through the dead
  host are now refused at the pull site (rejection test added).
- api/handler: dropped the legacy catalog-proxy fallback URL.
- .gitmodules: indeedhub submodule repointed to the OVH Gitea.
- scripts, image-recipe, app-catalog data, neode-ui strings, docs, and all
  test fixtures repointed to 146.59.87.168:3000 (or neutral example hosts).
- image-versions.sh: ARCHY_REGISTRY_FALLBACK emptied (guarded consumers
  skip it); reconcile-containers.sh candidate guard hardened.

The only remaining occurrences of the host string are the strip/reject
enforcement paths and their regression tests — the code that guarantees it
is never used again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/bootstrap-switchover.sh

@@ -78,7 +78,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^electrumx$'; then
         -e "DAEMON_URL=http://${RPC_USER}:${RPC_PASS}@bitcoin-knots:8332/" \
         -e COIN=Bitcoin -e DB_DIRECTORY=/data \
         -e "SERVICES=tcp://:50001,rpc://0.0.0.0:8000" \
-        "${ELECTRUMX_IMAGE:-git.tx1138.com/lfg2025/electrumx:v1.18.0}"
+        "${ELECTRUMX_IMAGE:-146.59.87.168:3000/lfg2025/electrumx:v1.18.0}"
 fi
 
 # Mempool API
@@ -98,7 +98,7 @@ if $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^mempool-api$'; th
         -e "DATABASE_ENABLED=true" -e "DATABASE_HOST=archy-mempool-db" \
         -e "DATABASE_DATABASE=mempool" -e "DATABASE_USERNAME=mempool" \
         -e "DATABASE_PASSWORD=$(cat "$SECRETS_DIR/mempool-db-password" 2>/dev/null || echo mempoolpass)" \
-        "${MEMPOOL_API_IMAGE:-git.tx1138.com/lfg2025/mempool-api:v3.2.0}"
+        "${MEMPOOL_API_IMAGE:-146.59.87.168:3000/lfg2025/mempool-api:v3.2.0}"
 fi
 
 # Stop Tor tunnel if it was active

scripts/deploy-bitcoin-knots.sh

@@ -74,7 +74,7 @@ mkdir -p "$BUILD_DIR"
 
 # Create Dockerfile
 cat > "$BUILD_DIR/Dockerfile" << 'EOF'
-FROM ${NGINX_ALPINE_IMAGE:-git.tx1138.com/lfg2025/nginx:1.29.6-alpine}
+FROM ${NGINX_ALPINE_IMAGE:-146.59.87.168:3000/lfg2025/nginx:1.29.6-alpine}
 
 # Copy the static UI
 COPY index.html /usr/share/nginx/html/

scripts/dev-container-test.sh

@@ -146,7 +146,7 @@ run_smoke_tests() {
 
     # Test 3: Install a lightweight container (filebrowser — small, fast, no deps)
     TESTS=$((TESTS + 1))
-    local install_img="git.tx1138.com/lfg2025/filebrowser:v2.27.0"
+    local install_img="146.59.87.168:3000/lfg2025/filebrowser:v2.27.0"
     # Check if already installed
     local fb_state
     fb_state=$(ssh $SSH_OPTS "$SSH_HOST" "podman inspect filebrowser --format '{{.State.Status}}' 2>/dev/null || echo 'none'")

scripts/first-boot-containers.sh

@@ -9,7 +9,7 @@
 #
 # Image versions: sourced from /opt/archipelago/image-versions.sh (single source of truth).
 # All container image references use the $*_IMAGE variables defined there.
-# Images pull from the Archipelago app registry (git.tx1138.com/lfg2025/).
+# Images pull from the Archipelago app registry (146.59.87.168:3000/lfg2025/).
 #
 # --- PLANNED REFACTOR (post-beta) ---
 # This script is ~995 lines and should be split into a modular library.

scripts/image-versions.sh

@@ -11,7 +11,8 @@
 
 # Archipelago app registries (primary + fallback)
 ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"
-ARCHY_REGISTRY_FALLBACK="git.tx1138.com/lfg2025"
+# No fallback registry: the old tx1138 registry host was retired (2026-06-13); empty disables the fallback path.
+ARCHY_REGISTRY_FALLBACK=""
 
 # Bitcoin stack
 BITCOIN_KNOTS_IMAGE="$ARCHY_REGISTRY/bitcoin-knots:latest"

scripts/reconcile-containers.sh

@@ -304,7 +304,7 @@ resolve_spec_image() {
     "${ARCHY_REGISTRY_FALLBACK:-}/${image_path}" \
     "80.71.235.15:3000/archipelago/${image_name}:${image_tag}" \
     "80.71.235.15:3000/lfg2025/${image_name}:${image_tag}"; do
-    [ "$candidate" = "/" ] && continue
+    case "$candidate" in /*) continue;; esac
     if image_exists "$candidate"; then
       info "$SPEC_NAME — using local image alias $candidate"
       SPEC_IMAGE="$candidate"

scripts/self-update.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Self-update: pull latest code from git.tx1138.com and apply
+# Self-update: pull latest code from the OVH Gitea (146.59.87.168:3000) and apply
 # Designed to run on installed Archipelago nodes (as archipelago user)
 #
 # Usage:
@@ -8,7 +8,7 @@
 #   ./self-update.sh --force      # Apply even if already up to date
 #
 # The script:
-#   1. Pulls latest code from origin (git.tx1138.com)
+#   1. Pulls latest code from origin (146.59.87.168:3000)
 #   2. Builds the Rust backend (release mode)
 #   3. Builds the Vue frontend (production mode)
 #   4. Installs the new binary and web UI
@@ -69,7 +69,7 @@ done
 # Ensure repo exists
 if [ ! -d "$REPO_DIR/.git" ]; then
     err "Repo not found at $REPO_DIR"
-    err "Clone it first: git clone https://git.tx1138.com/lfg2025/archy ~/archy"
+    err "Clone it first: git clone http://146.59.87.168:3000/lfg2025/archy ~/archy"
     exit 1
 fi
 

scripts/validate-app-manifest.sh

@@ -86,7 +86,7 @@ else
 
     # Check trusted registry
     TRUSTED=false
-    for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "git.tx1138.com"; do
+    for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "146.59.87.168:3000"; do
         if echo "$IMAGE" | grep -q "$reg"; then
             TRUSTED=true
             break