Serve every tool on deployshed.com instead of nip.io

Harbor, Gitea, Argo CD, Jenkins, Vault, Grafana and vmui now answer on
their deployshed.com names alone. Each was already serving both while the
move was proved out; this removes the nip.io half.

The dual-hostname workarounds go with it. Jenkins' secondaryingress existed
only because its chart's primary ingress takes one hostName and a
certificate could not span both names — the real domain moves onto the
primary with jenkins-tls, which it already holds. Argo CD gets extraTls
rather than ingress.tls, because the boolean hardcodes secretName
argocd-server-tls and would request a second certificate for a name that
already has a valid one in argocd-deployshed-tls.

Harbor also changes in two ways beyond the hostname:

  - externalURL moves to https://harbor.infra.deployshed.com. Harbor hands
    this to docker clients in its own API responses and builds the push
    commands shown in its UI from it, so a stale value is what makes a
    correctly-configured registry still advertise the old address.

  - updateStrategy is now Recreate. Its jobservice and registry volumes are
    standard-rwo (ReadWriteOnce), and a RollingUpdate starts the new pod
    before the old one releases the disk, so the replacement hangs forever
    on Multi-Attach. The cluster was sitting in exactly that state, old pods
    serving while new ones stayed in ContainerCreating. The chart's own
    comment on this value recommends Recreate when RWM is unavailable. The
    cost is a brief outage during upgrades, which beats a rollout that
    cannot complete.

The private registry CA is not removed yet. Apps deployed before this move
recorded nip.io image references that only change when each is rebuilt, so
the old hostname stays served by a standalone Ingress until then.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

helm-overrides/gke-toolshed-prd-usc1/gitea/custom-values.yaml

@@ -43,7 +43,7 @@ gitea:
       actions:
         ENABLED: true
       server:
-        ROOT_URL: http://gitea.35.238.248.203.nip.io/
+        ROOT_URL: https://gitea.infra.deployshed.com/
       service:
         # The homelab sat on a LAN; this Gitea is on a public IP. Open
         # registration would let anyone on the internet create an account.
@@ -69,7 +69,7 @@ gitea:
         # The proper fix is a configurable webhook base URL in toolshed
         # pointing at toolshed-api.toolshed.svc.cluster.local:8080, after
         # which this entry should be removed.
-        ALLOWED_HOST_LIST: private,toolshed.35.238.248.203.nip.io
+        ALLOWED_HOST_LIST: private,console.deployshed.com
     admin:
       username: gitadmin
       # Created by hand with kubectl at bootstrap, because Vault and ESO
@@ -82,22 +82,20 @@ gitea:
   # Contour does not exist yet at bootstrap — the Ingress just sits unused
   # until ArgoCD installs it.
   #
-  # Two hosts while the deployment moves onto its own domain. The nip.io one
-  # stays until everything that references it has been repointed — ROOT_URL
-  # below, and any git remote anyone has configured.
+  # One host. The nip.io name was served alongside this one while the
+  # deployment moved onto its own domain, and came out once everything
+  # referencing it had been repointed: ROOT_URL above, the webhook allow-list
+  # above that, and any git remote anyone had configured.
   ingress:
     enabled: true
     className: contour
     annotations:
-      # Issues the certificate named in tls below. Only the real domain is
-      # listed there: Let's Encrypt cannot issue for nip.io, and asking for
-      # one certificate spanning both names returns nothing for either.
+      # Issues the certificate named in tls below. This could only ever cover
+      # the real domain: Let's Encrypt cannot issue for nip.io, so while both
+      # names were served, asking for one certificate spanning them returned
+      # nothing for either.
       cert-manager.io/cluster-issuer: letsencrypt-prod
     hosts:
-      - host: gitea.35.238.248.203.nip.io
-        paths:
-          - path: /
-            pathType: Prefix
       - host: gitea.infra.deployshed.com
         paths:
           - path: /