rebrand: Switchboard Core → Armature

- Rename Go module switchboard-core → armature (155+ files)
- Rename Docker image → gobha/armature
- Rename K8s resources, secrets, deployments
- Rename Prometheus metrics switchboard_* → armature_*
- Rename env vars SWITCHBOARD_ADMIN_* → ARMATURE_ADMIN_*
- Rename DB names switchboard_core* → armature*
- Update all frontend branding, notification templates, docs
- Update CI scripts, e2e tests, Keycloak realm, nginx conf
- Rename scripts/switchboard-ca.sh → scripts/armature-ca.sh
- Rename k8s/switchboard.yaml → k8s/armature.yaml
- Rename chart alerting/dashboard files
- Fix: DockerHub push uses env: binding for secret injection
- Helm chart updated (name, labels, template functions, dashboard, alerting)
- Replace favicon/icon assets with Armature brand

No functional changes. Pure mechanical rename + CI fix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/crypto/rekey.go

@@ -15,7 +15,7 @@ import (
 //
 // Usage:
 //
-//	switchboard vault rekey
+//	armature vault rekey
 //	  ENCRYPTION_KEY     = current/old key
 //	  NEW_ENCRYPTION_KEY = new key to re-encrypt with
 func Rekey(db *sql.DB, oldEnvKey, newEnvKey string) error {

server/crypto/status.go

@@ -13,7 +13,7 @@ type VaultStatusInfo struct {
 }
 
 // VaultStatus gathers vault health metrics from the database.
-// Used by both the CLI (`switchboard vault status`) and the admin API endpoint.
+// Used by both the CLI (`armature vault status`) and the admin API endpoint.
 func VaultStatus(db *sql.DB, encryptionKey string) (*VaultStatusInfo, error) {
 	if db == nil {
 		return nil, fmt.Errorf("database not available")

server/crypto/vault.go

@@ -1,4 +1,4 @@
-// Package crypto provides API key encryption primitives for Switchboard Core.
+// Package crypto provides API key encryption primitives for Armature.
 //
 // Two-tier model:
 //
@@ -59,7 +59,7 @@ func DeriveKeyFromEnv(envValue string) ([]byte, error) {
 	}
 	// HKDF with SHA-256: extract + expand with context string for domain separation.
 	// No salt (nil) — the env value itself is the input keying material.
-	hkdfReader := hkdf.New(sha256.New, []byte(envValue), nil, []byte("switchboard-api-key-encryption-v1"))
+	hkdfReader := hkdf.New(sha256.New, []byte(envValue), nil, []byte("armature-api-key-encryption-v1"))
 	key := make([]byte, 32)
 	if _, err := io.ReadFull(hkdfReader, key); err != nil {
 		return nil, fmt.Errorf("HKDF derivation failed: %w", err)