feat(registry): move image and OTA references to the public domain

Replaces the registry host across 86 files: 309 references, covering all 40
app manifests, the orchestrator and container crates, the release and catalog
scripts, both demo-images workflows, the ISO builder, demo-deploy, and the
frontend marketplace data.

Verified the domain actually serves the registry before rewriting anything,
rather than assuming the web host implies the registry:
- TLS verifies clean, HTTP/2 on the web root
- an anonymous token grants a manifest fetch (HTTP 200) with no credentials
- skopeo inspect --no-creds resolves an image and lists its tags

That last check is the one that matters: an outside developer with no account
can now pull, which was the functional blocker for publishing at all.

Plain-HTTP references become HTTPS in the same pass, so OTA downloads stop
crossing the network in the clear.

Deliberately NOT rewritten:
- The public FIPS anchor on port 8444. It is a functional network endpoint
  every node dials to bootstrap the mesh — closer to Bitcoin Core's hardcoded
  seeds than to leaked infrastructure. The domain does resolve to the same
  host, so it could become a hostname, but that adds a DNS dependency to the
  path used precisely when things are broken. Worth a deliberate decision,
  not a side effect of this change.
- The companion APK on port 2100. The domain returns 404 for that path, so
  rewriting it would swap a working URL for a broken one. The Releases page
  does serve (200), which is where the plan already wants those binaries.
- releases/app-catalog.json, releases/manifest.json and release-manifest.json.
  These carry `signature` and `signed_by`; editing their contents invalidates
  the signature and the fleet refuses artifacts that fail verification. They
  were rewritten in a first pass and reverted — they must be regenerated and
  re-signed through the signing ceremony instead, which needs the mnemonic.

So the catalog still advertises the old host until that ceremony runs. Nodes
resolve images through the signed catalog, not the on-disk manifests, so this
commit alone does not change what a node pulls.

Verified: archipelago-container 75/75; every manifest still parses with a
top-level app block; no signed artifact modified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -71,7 +71,7 @@ arbitrary app catalog to the entire fleet — fully unattended under
       install cosign + publish real `image_signature` values (in that order); tracked with
       the Workstream B signing ceremony item.
 - [ ] 🟠 **Move the image mirror to HTTPS; drop `--tls-verify=false`.**
-      `podman_client.rs:641` `INSECURE_REGISTRY_HOSTS = ["146.59.87.168:3000"]` +
+      `podman_client.rs:641` `INSECURE_REGISTRY_HOSTS = ["source.archipelago-foundation.org"]` +
       `config.rs:104,124` allowlist pull images over unauthenticated HTTP. Remove the raw-IP
       entries; give the mirror a valid/pinned cert. (Same host also baked insecurely into
       the ISO — see §F.)
@@ -310,7 +310,7 @@ media (latest artifact only one minor behind).
       `archipelago ceremony verify` against the pinned anchor; build host never holds the
       key). **Still open:** Secure Boot — `BOOTX64.EFI` is unsigned though
       `grub-efi-amd64-signed` is installed.
-- [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000`
+- [ ] 🟠 **Registries over HTTPS in the image too** — `source.archipelago-foundation.org`
       are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.)
 - [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 +
       mesh/WG). Neither exists today; OS packages drift until reflash and there is no host

docs/archive/demo-deployment-design.md

@@ -46,7 +46,7 @@ layer**.
   CI: build archy-demo-web + archy-demo-backend
             │  push :demo / :latest
             ▼
-  registry (146.59.87.168:3000 / vps2)
+  registry (source.archipelago-foundation.org / vps2)
             │  Portainer webhook / re-pull
             ▼
   archy-demo (public repo — tiny)
@@ -162,7 +162,7 @@ Today filebrowser upload/delete/rename are 200-OK no-ops.
 
 1. **Demo host** — which Portainer instance (OVH `.168`? a dedicated VPS)? Public
    DNS + TLS for `demo.<domain>`?
-2. **Registry for `:demo` images** — `146.59.87.168:3000` vs vps2; public-pull or
+2. **Registry for `:demo` images** — `source.archipelago-foundation.org` vs vps2; public-pull or
    creds baked into Portainer?
 3. **Session TTL + concurrency cap** — concrete numbers (30 min / N sessions / 50 MB)?
 4. **Chat in the demo** — enable Claude chat (needs key + budget cap) or stub it?

docs/bitcoin-multi-version-design.md

@@ -111,7 +111,7 @@ green first), `MEMORY → project_decoupled_app_updates`,
 |-------|-------|
 | `apps/bitcoin-core/Dockerfile` | `FROM bitcoin/bitcoin:24.0` — a **community** image, **stale** (manifest says 28.4), no project-official Docker image exists |
 | `apps/bitcoin-knots/` | **no Dockerfile** — `:latest` is built/pushed by hand |
-| Registry | `scripts/image-versions.sh` → `ARCHY_REGISTRY="146.59.87.168:3000/lfg2025"`; only `BITCOIN_KNOTS_IMAGE=…/bitcoin-knots:latest` pinned, no Core pin |
+| Registry | `scripts/image-versions.sh` → `ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"`; only `BITCOIN_KNOTS_IMAGE=…/bitcoin-knots:latest` pinned, no Core pin |
 | Tags in registry | **one tag per image**. No historical versions. |
 
 ### Version pinning

docs/bitcoin-version-bulletproof-rollout.md

@@ -45,7 +45,7 @@ Three **stacked** bugs, plus a data-corruption hazard:
   removed `USER bitcoin` → run as **container-root** like legacy (still 100% rootless:
   container-root maps to the unprivileged host service user; `CAP_DAC_OVERRIDE` from the
   manifest lets bitcoind read the `data_uid`-owned datadir). **All** images rebuilt root +
-  pushed to the mirror (`146.59.87.168:3000/lfg2025`):
+  pushed to the mirror (`source.archipelago-foundation.org/lfg2025`):
   - Knots: `29.3.knots20260508`, `29.3.knots20260507`, `29.3.knots20260210`, `29.2.knots20251110`
   - Core: `25.2 26.2 27.2 28.4 29.2 29.3 30.2 31.0` + `latest` (→31.0)
 - **Catalog** (`scripts/generate-app-catalog.sh` VERSIONS map + regenerated

docs/container-architecture.html

@@ -842,7 +842,7 @@
         </ul>
         <h4>Registry</h4>
         <ul>
-          <li>Private registry at <code>146.59.87.168:3000/lfg2025/</code></li>
+          <li>Private registry at <code>source.archipelago-foundation.org/lfg2025/</code></li>
           <li>HTTPS (self-hosted Gitea)</li>
           <li>All images pre-pulled into registry; nodes pull on first boot</li>
         </ul>

docs/demo-build-info.md

@@ -3,7 +3,7 @@
 **Status:** implemented & deployable (2026-07-14)
 **Branch:** `main` — the demo machinery was merged from the old `demo-build`
 branch and now lives on main, pushed to
-`gitea-vps2` = `http://146.59.87.168:3000/lfg2025/archy.git`.
+`gitea-vps2` = `https://source.archipelago-foundation.org/lfg2025/archy.git`.
 
 A public, click-to-play demo of the Archipelago UI, 100% mock-data driven,
 multi-visitor, deployed via Portainer. See also `docs/archive/demo-deployment-design.md`
@@ -17,7 +17,7 @@ Build-from-repo (works today, no registry needed):
 
 | Field | Value |
 |-------|-------|
-| Repository URL | `http://146.59.87.168:3000/lfg2025/archy.git` |
+| Repository URL | `https://source.archipelago-foundation.org/lfg2025/archy.git` |
 | Reference | `refs/heads/main` |
 | Compose path | `docker-compose.demo.yml` |
 | Auth | user `lfg2025`, password = Gitea token |

docs/dht-distribution-design.md

@@ -28,7 +28,7 @@ origin":
 
 ### OTA (`core/archipelago/src/update.rs`)
 - Manifest at `DEFAULT_UPDATE_MANIFEST_URL` (`update.rs:67`) = vps2 OVH
-  (`146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json`).
+  (`source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json`).
 - `check_for_updates()` (`:565`) walks an operator mirror list (`default_mirrors()` `:105`,
   `load_mirrors()` `:123`), origin-rewrites component URLs to the chosen mirror
   (`rewrite_manifest_origins()` `:227`).
@@ -65,9 +65,9 @@ origin":
 
 ### IndeeHub (the streaming target)
 - Original platform (not a fork). Working source: `~/Projects/Indeedhub Prototype/`
-  (Vue 3 + NestJS). Submodule `146.59.87.168:3000/lfg2025/indeehub.git` (repointed off the retired host —
+  (Vue 3 + NestJS). Submodule `source.archipelago-foundation.org/lfg2025/indeehub.git` (repointed off the retired host —
   needs a live remote). In `archy`: image-only, `apps/indeedhub/manifest.yml` pulls
-  `146.59.87.168:3000/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis,
+  `source.archipelago-foundation.org/lfg2025/indeedhub:1.0.0` (+ `-api`, `-ffmpeg`, postgres, redis,
   minio, nostr-rs-relay).
 - Streaming today: FFmpeg → **HLS (.m3u8 + AES-128 .ts segments)** in **MinIO**
   (`indeedhub-private`/`-public`), metadata in Postgres, transcode queue in Redis,

docs/dual-ecash-design.md

@@ -94,7 +94,7 @@ in sync with the manifest env. clientd is a **client, not the guardian** — it
   under `image-recipe/_archived/` (likely stale); `first-boot-containers.sh`/`image-versions.sh`
   are current.
 - Image: build from source (no official image; `flake.nix` only) → push to vps2
-  `146.59.87.168:3000/lfg2025/fedimint-clientd:v0.4.0`.
+  `source.archipelago-foundation.org/lfg2025/fedimint-clientd:v0.4.0`.
 
 ### 5. Unified balance
 `HomeWalletCard` ecash row = Cashu `wallet.ecash-balance` + Fedimint `wallet.fedimint-balance`.