chore: retire .23 VPS mirror, promote .168 OVH to primary

The Hetzner VPS at 23.182.128.160 was decommissioned. Replace it
everywhere with the OVH VPS at 146.59.87.168, which was previously
the tertiary mirror.

  - update.rs: drop DEFAULT_TERTIARY_MIRROR_URL, promote .168 into
    the secondary slot as "Server 1 (OVH)"; tx1138 becomes Server 2.
    Default mirror list shrinks from 3 to 2.
  - container/registry.rs: default RegistryConfig drops .23, promotes
    .168 to Server 1 / priority 0, tx1138 stays Server 2 / priority 10.
  - api/rpc/package/config.rs: trusted-registry allowlist swaps .23
    for .168.
  - api/handler/mod.rs: app-catalog fallback URL uses .168.
  - neode-ui/views/marketplace/marketplaceData.ts: REGISTRY uses .168.
  - scripts/image-versions.sh: ARCHY_REGISTRY_FALLBACK uses .168.
  - image-recipe/build-auto-installer-iso.sh: installer ISO registries
    use .168 (both podman registries.conf and backend registries.json).

Tests updated to assert on the new 2-entry default lists (registry +
mirror). URL-parser fixture tests in update.rs retain .23 strings —
they exercise string-parsing logic, not mirror policy.

Git remotes: dropped `gitea-vps` and the .23 push URL on the `origin`
multi-push alias (not part of this commit — pure working-copy change).

core/archipelago/src/api/handler/mod.rs

@@ -146,7 +146,7 @@ impl ApiHandler {
         }
         if upstreams.is_empty() {
             upstreams.push(
-                "http://23.182.128.160:3000/lfg2025/app-catalog/raw/branch/main/catalog.json"
+                "http://146.59.87.168:3000/lfg2025/app-catalog/raw/branch/main/catalog.json"
                     .to_string(),
             );
             upstreams.push(

core/archipelago/src/api/rpc/package/config.rs

@@ -9,7 +9,7 @@ pub(super) const TRUSTED_REGISTRIES: &[&str] = &[
     "ghcr.io/",
     "localhost/",
     "git.tx1138.com/",
-    "23.182.128.160:3000/",
+    "146.59.87.168:3000/",
 ];
 
 /// Validate Docker image against trusted registry allowlist.
@@ -29,7 +29,7 @@ pub(super) fn is_valid_docker_image(image: &str) -> bool {
     };
     matches!(
         registry,
-        "docker.io" | "ghcr.io" | "localhost" | "git.tx1138.com" | "23.182.128.160:3000"
+        "docker.io" | "ghcr.io" | "localhost" | "git.tx1138.com" | "146.59.87.168:3000"
     )
 }
 

core/archipelago/src/api/rpc/package/install.rs

@@ -1589,7 +1589,7 @@ server {
             .unwrap_or(true);
 
         // Registries are configured as `host[:port]/namespace` (for
-        // example `23.182.128.160:3000/lfg2025`), but the Docker V2
+        // example `146.59.87.168:3000/lfg2025`), but the Docker V2
         // registry API lives at `/v2/` on the ROOT of the host — NOT
         // under the namespace. Strip the namespace before appending
         // `/v2/` so the reachability probe hits the correct URL.