security: untrack operations docs; scrub infra identifiers from public docs

Operations docs move out of git entirely rather than being sanitized. They
stay on disk for local use and are gitignored, so the Phase 6 export (which
takes HEAD) can never carry them. 15 files: the fleet runbook, hotfix
process, node inventories, internal trackers, session handoffs, the key
rotation/signing-posture records, and the open-source plan itself.

For the docs that remain public, infra identifiers are replaced with things
that are better documentation rather than placeholders: curl examples now
use `archipelago.local`, the product's own mDNS name, so a reader can run
them as-is instead of substituting an address that was never theirs.

Deliberately NOT scrubbed, both verified as functional rather than leaked:
- `tx1138.com` is the shipped default block explorer (DEFAULT_TX_EXPLORER in
  useTxExplorer.ts, surfaced in WalletSettingsModal). Product behavior.
- `git.tx1138.com` in core/container/{image_policy,registry}.rs is a retired-
  registry constant the code matches on to strip stale entries from legacy
  node configs. Removing it would break migration for older nodes.
- `192.168.1.254` in bulletproof-containers.md is the LAN gateway in a podman
  bug description, and `192.168.1.x` in user-walkthrough.md is already generic.

Whether a personal domain should be the shipped explorer default in a public
product is a separate product question, not a security one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/bitcoin-rpc-relay.md

@@ -171,7 +171,7 @@ http://<archipelago-lan-ip>:80
 For the tested node the LAN upstream was:
 
 ```text
-http://192.168.1.116:80
+http://archipelago.local:80
 ```
 
 The public proxy should serve a valid TLS certificate for the chosen subdomain.
@@ -276,7 +276,7 @@ Expected result:
 The working endpoint used in this setup was:
 
 ```text
-https://shard.tx1138.com/
+https://<your-mempool-instance>/
 ```
 
 It was verified with: