rebrand: Switchboard Core → Armature

- Rename Go module switchboard-core → armature (155+ files)
- Rename Docker image → gobha/armature
- Rename K8s resources, secrets, deployments
- Rename Prometheus metrics switchboard_* → armature_*
- Rename env vars SWITCHBOARD_ADMIN_* → ARMATURE_ADMIN_*
- Rename DB names switchboard_core* → armature*
- Update all frontend branding, notification templates, docs
- Update CI scripts, e2e tests, Keycloak realm, nginx conf
- Rename scripts/switchboard-ca.sh → scripts/armature-ca.sh
- Rename k8s/switchboard.yaml → k8s/armature.yaml
- Rename chart alerting/dashboard files
- Fix: DockerHub push uses env: binding for secret injection
- Helm chart updated (name, labels, template functions, dashboard, alerting)
- Replace favicon/icon assets with Armature brand

No functional changes. Pure mechanical rename + CI fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/oidc.go

@@ -18,17 +18,17 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 
-	"switchboard-core/models"
-	"switchboard-core/store"
+	"armature/models"
+	"armature/store"
 )
 
 // OIDCConfig holds OIDC-specific configuration from env vars.
 type OIDCConfig struct {
-	IssuerURL    string // e.g. "https://keycloak.corp/realms/switchboard"
+	IssuerURL    string // e.g. "https://keycloak.corp/realms/armature"
 	ExternalIssuerURL string // browser-facing URL (optional, defaults to IssuerURL)
 	ClientID     string
 	ClientSecret string
-	RedirectURL  string // e.g. "https://switchboard.corp/api/v1/auth/oidc/callback"
+	RedirectURL  string // e.g. "https://armature.corp/api/v1/auth/oidc/callback"
 	AutoActivate bool   // auto-activate new users (default true)
 	DefaultTeam  string // team ID for auto-provisioned users (optional)
 	RolesClaim   string // JWT claim for role mapping (default "realm_access.roles")
@@ -435,7 +435,7 @@ func (p *OIDCProvider) extractGroups(claims *oidcClaims) []string {
 	// Keycloak puts groups in different places depending on mapper config.
 	// Try the configured claim path as a fallback.
 	// The claims.Groups field handles the simple case. This handles
-	// nested paths like "resource_access.switchboard.roles".
+	// nested paths like "resource_access.armature.roles".
 	// For now, return empty — the direct Groups field covers the
 	// standard Keycloak group mapper output.
 	return nil