rebrand: Switchboard Core → Armature

- Rename Go module switchboard-core → armature (155+ files)
- Rename Docker image → gobha/armature
- Rename K8s resources, secrets, deployments
- Rename Prometheus metrics switchboard_* → armature_*
- Rename env vars SWITCHBOARD_ADMIN_* → ARMATURE_ADMIN_*
- Rename DB names switchboard_core* → armature*
- Update all frontend branding, notification templates, docs
- Update CI scripts, e2e tests, Keycloak realm, nginx conf
- Rename scripts/switchboard-ca.sh → scripts/armature-ca.sh
- Rename k8s/switchboard.yaml → k8s/armature.yaml
- Rename chart alerting/dashboard files
- Fix: DockerHub push uses env: binding for secret injection
- Helm chart updated (name, labels, template functions, dashboard, alerting)
- Replace favicon/icon assets with Armature brand

No functional changes. Pure mechanical rename + CI fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

k8s/armature.yaml

@@ -1,14 +1,14 @@
-# k8s/switchboard.yaml
+# k8s/armature.yaml
 # ============================================
-# Switchboard Core - Deployment
+# Armature Core - Deployment
 # ============================================
 # Secrets:
-#   switchboard-db-credentials  - POSTGRES_USER, POSTGRES_PASSWORD
-#   switchboard-admin           - username, password, email (optional)
-#   switchboard-encryption      - ENCRYPTION_KEY (required for v0.9.4+)
+#   armature-db-credentials  - POSTGRES_USER, POSTGRES_PASSWORD
+#   armature-admin           - username, password, email (optional)
+#   armature-encryption      - ENCRYPTION_KEY (required for v0.9.4+)
 #
 # PVC:
-#   switchboard-storage         - Extraction scratch (always needed)
+#   armature-storage         - Extraction scratch (always needed)
 #   Requires ReadWriteMany (RWX) — see k8s/storage-pvc.yaml
 #   With S3 backend, PVC is small (extraction status only, not blobs)
 #
@@ -23,32 +23,32 @@
 #   S3_ACCESS_KEY               - S3 access key
 #   S3_SECRET_KEY               - S3 secret key
 #
-# Admin bootstrap: on every pod start, if SWITCHBOARD_ADMIN_* env vars
+# Admin bootstrap: on every pod start, if ARMATURE_ADMIN_* env vars
 # are set, the backend upserts an admin user. Change the secret and
 # restart the pod to reset the admin password.
 # ============================================
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: switchboard${DEPLOY_SUFFIX}
+  name: armature${DEPLOY_SUFFIX}
   namespace: ${NAMESPACE}
   labels:
-    app: switchboard
+    app: armature
     env: ${ENVIRONMENT}
 spec:
   replicas: ${REPLICAS}
   selector:
     matchLabels:
-      app: switchboard
+      app: armature
       env: ${ENVIRONMENT}
   template:
     metadata:
       labels:
-        app: switchboard
+        app: armature
         env: ${ENVIRONMENT}
     spec:
       containers:
-      - name: switchboard
+      - name: armature
         image: ${IMAGE}:${IMAGE_TAG}
         imagePullPolicy: Always
         ports:
@@ -72,43 +72,43 @@ spec:
         - name: POSTGRES_USER
           valueFrom:
             secretKeyRef:
-              name: switchboard-db-credentials
+              name: armature-db-credentials
               key: POSTGRES_USER
         - name: POSTGRES_PASSWORD
           valueFrom:
             secretKeyRef:
-              name: switchboard-db-credentials
+              name: armature-db-credentials
               key: POSTGRES_PASSWORD
         - name: DATABASE_URL
           value: "postgres://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)?sslmode=disable"
-        - name: SWITCHBOARD_ADMIN_USERNAME
+        - name: ARMATURE_ADMIN_USERNAME
           valueFrom:
             secretKeyRef:
-              name: switchboard-admin
+              name: armature-admin
               key: username
               optional: true
-        - name: SWITCHBOARD_ADMIN_PASSWORD
+        - name: ARMATURE_ADMIN_PASSWORD
           valueFrom:
             secretKeyRef:
-              name: switchboard-admin
+              name: armature-admin
               key: password
               optional: true
-        - name: SWITCHBOARD_ADMIN_EMAIL
+        - name: ARMATURE_ADMIN_EMAIL
           valueFrom:
             secretKeyRef:
-              name: switchboard-admin
+              name: armature-admin
               key: email
               optional: true
         - name: SEED_USERS
           valueFrom:
             secretKeyRef:
-              name: switchboard-seed-users
+              name: armature-seed-users
               key: users
               optional: true
         - name: ENCRYPTION_KEY
           valueFrom:
             secretKeyRef:
-              name: switchboard-encryption
+              name: armature-encryption
               key: ENCRYPTION_KEY
               optional: true
         # File storage (v0.12.0+)
@@ -120,37 +120,37 @@ spec:
         - name: S3_ENDPOINT
           valueFrom:
             secretKeyRef:
-              name: switchboard-s3
+              name: armature-s3
               key: S3_ENDPOINT
               optional: true
         - name: S3_BUCKET
           valueFrom:
             secretKeyRef:
-              name: switchboard-s3
+              name: armature-s3
               key: S3_BUCKET
               optional: true
         - name: S3_ACCESS_KEY
           valueFrom:
             secretKeyRef:
-              name: switchboard-s3
+              name: armature-s3
               key: S3_ACCESS_KEY
               optional: true
         - name: S3_SECRET_KEY
           valueFrom:
             secretKeyRef:
-              name: switchboard-s3
+              name: armature-s3
               key: S3_SECRET_KEY
               optional: true
         - name: S3_REGION
           valueFrom:
             secretKeyRef:
-              name: switchboard-s3
+              name: armature-s3
               key: S3_REGION
               optional: true
         - name: S3_PREFIX
           valueFrom:
             secretKeyRef:
-              name: switchboard-s3
+              name: armature-s3
               key: S3_PREFIX
               optional: true
         - name: S3_FORCE_PATH_STYLE
@@ -191,19 +191,19 @@ spec:
       volumes:
       - name: storage
         persistentVolumeClaim:
-          claimName: switchboard-storage${DEPLOY_SUFFIX}
+          claimName: armature-storage${DEPLOY_SUFFIX}
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: switchboard${DEPLOY_SUFFIX}
+  name: armature${DEPLOY_SUFFIX}
   namespace: ${NAMESPACE}
   labels:
-    app: switchboard
+    app: armature
     env: ${ENVIRONMENT}
 spec:
   selector:
-    app: switchboard
+    app: armature
     env: ${ENVIRONMENT}
   ports:
   - protocol: TCP

k8s/ingress.yaml

@@ -1,11 +1,11 @@
 # k8s/ingress.yaml
 # ============================================
-# Switchboard Core - Ingress
+# Armature Core - Ingress
 # ============================================
 # Path-based routing on a single domain:
-#   switchboard.DOMAIN/         → production
-#   switchboard.DOMAIN/test/    → test (main branch)
-#   switchboard.DOMAIN/dev/     → dev  (PR branches)
+#   armature.DOMAIN/         → production
+#   armature.DOMAIN/test/    → test (main branch)
+#   armature.DOMAIN/dev/     → dev  (PR branches)
 #
 # Each environment deploys its own Ingress resource.
 # Traefik merges rules for the same host automatically.
@@ -18,29 +18,29 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: switchboard${DEPLOY_SUFFIX}
+  name: armature${DEPLOY_SUFFIX}
   namespace: ${NAMESPACE}
   annotations:
     cert-manager.io/cluster-issuer: "${CERT_ISSUER}"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
   labels:
-    app: switchboard
+    app: armature
     env: ${ENVIRONMENT}
 spec:
   ingressClassName: "traefik"
   tls:
   - hosts:
     - ${DEPLOY_HOST}
-    secretName: switchboard-tls
+    secretName: armature-tls
   rules:
   - host: "${DEPLOY_HOST}"
     http:
       paths:
-      # All traffic → switchboard (unified image)
+      # All traffic → armature (unified image)
       - path: ${BASE_PATH}/
         pathType: Prefix
         backend:
           service:
-            name: switchboard${DEPLOY_SUFFIX}
+            name: armature${DEPLOY_SUFFIX}
             port:
               number: 80

k8s/middleware-retry.yaml

@@ -1,6 +1,6 @@
 # k8s/middleware-retry.yaml
 # ============================================
-# Switchboard Core - Traefik Retry Middleware
+# Armature Core - Traefik Retry Middleware
 # ============================================
 # Retries failed requests (502, connection reset) once before giving up.
 # Applies to API + WebSocket paths via the Ingress annotation.
@@ -15,10 +15,10 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
-  name: switchboard-retry${DEPLOY_SUFFIX}
+  name: armature-retry${DEPLOY_SUFFIX}
   namespace: ${NAMESPACE}
   labels:
-    app: switchboard
+    app: armature
     env: ${ENVIRONMENT}
 spec:
   retry:

k8s/rbac-traefik.yaml

@@ -16,7 +16,7 @@ metadata:
   name: traefik-middleware-manager
   namespace: ${NAMESPACE}
   labels:
-    app: switchboard
+    app: armature
 rules:
   - apiGroups: ["traefik.io"]
     resources: ["middlewares"]
@@ -28,7 +28,7 @@ metadata:
   name: gitea-runner-traefik-middleware
   namespace: ${NAMESPACE}
   labels:
-    app: switchboard
+    app: armature
 subjects:
   - kind: ServiceAccount
     name: gitea-runner-sa

k8s/storage-pvc.yaml

@@ -1,6 +1,6 @@
 # k8s/storage-pvc.yaml
 # ============================================
-# Switchboard Core - Storage PVC
+# Armature Core - Storage PVC
 # ============================================
 # Persistent storage for file attachments, extraction queue,
 # and future knowledge base / compaction data.
@@ -17,10 +17,10 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: switchboard-storage${DEPLOY_SUFFIX}
+  name: armature-storage${DEPLOY_SUFFIX}
   namespace: ${NAMESPACE}
   labels:
-    app: switchboard
+    app: armature
     component: storage
     env: ${ENVIRONMENT}
 spec: