chore(gateway): drop schweitz.internal, default to http://tatlock:8000

The homelab is retiring the *.schweitz.internal domain; in-network
machine-to-machine traffic uses docker container names on the
docker-dataplane network. The deployed tatlock-ui stack already overrides
DESKLOCK_TATLOCK_BASE_URL (Tatlock runs on the host), so only the
fallback default changes.

Docs follow: AGENTS.md M2M guidance now points at container names with
*.schweitz.net reserved for browsers, architecture.md drops the retired
domain (the registry name now matches what CI actually pushes since
c477019), and the README diagram loses the stale hostname.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -6,8 +6,8 @@
 ## What this project is
 
 DeskLock is the living-room visual/audio endpoint for **Tatlock**, the homelab butler
-(`/mnt/media/Projects/tatlock`, API at `http://tatlock.schweitz.internal:8000`). Two halves,
-one repo:
+(`/mnt/media/Projects/tatlock`, API at `http://tatlock:8000` on `docker-dataplane`).
+Two halves, one repo:
 
 - `firmware/` — ESP-IDF (C, LVGL 9) app for the Waveshare ESP32-P4-WIFI6-Touch-LCD-3.4C
   (3.4" round 800×800 touch display, dual mics + ES7210 AEC, ES8311 codec + speaker).
@@ -124,7 +124,8 @@ make typecheck      # mypy
 ## Homelab context
 
 - This server **is** tower-of-joy; the device, gateway, and Tatlock all share the LAN.
-- Use `tatlock.schweitz.internal:8000` (direct, no SSO) — the public
-  `tatlock.schweitz.net` route sits behind Authentik and is not for machine-to-machine
-  traffic.
+- Machine-to-machine traffic uses container names on the `docker-dataplane` network —
+  `http://tatlock:8000` (the deployed stack overrides `DESKLOCK_TATLOCK_BASE_URL` to
+  the host LAN IP while Tatlock runs on the host). Browser-facing URLs use
+  `https://<name>.schweitz.net` (NPM, Authentik SSO) — never for M2M traffic.
 - Git remote: `git.schweitz.net` (Gitea).