Switch KB & Neo4j to new keboola.systems domain (ST-3586)

[Halama]

Summary

• Migrate all hostnames from old domains to the new keboola.systems convention
  • kb.internal.keboola.com → kb.keboola.systems
  • kb.staging.keboola.dev → kb.staging.keboola.systems
  • neo4j.internal.keboola.com → neo4j.keboola.systems
  • neo4j.staging.keboola.dev → neo4j.staging.keboola.systems
• Update Terraform variables (base_domain, staging_domain) defaults to keboola.systems
• Drop .internal segment from production hostname patterns
• Update all documentation to reflect new domains

Files changed

Terraform:

• deploy/terraform/variables.tf — new domain defaults
• deploy/terraform/load-balancer.tf — production KB hostname
• deploy/terraform/ssl-proxy-lb.tf — production Neo4j hostname
• deploy/terraform/cloudrun-neodash.tf — Neodash standaloneHost
• deploy/terraform/terraform.tfvars.example — example values

Docs:

• docs/WEB_UI_ACCESS.md — all domain references, DNS table
• docs/NEO4J_FIX_DOCUMENTATION.md — example outputs & config table
• plan/phases/13-web-ui/CHECKLIST.md — example domain

Excluded (intentionally unchanged)

• deploy/terraform/migration_backup/ — historical backups
• scripts/test-neo4j-connection.py — left as-is per request

Test plan

• Verify zero grep matches for old domains: grep -r "internal\.keboola\.com\|staging\.keboola\.dev" deploy/terraform/ docs/ plan/
• Run terraform plan to confirm expected resource changes (SSL certs, URL map, Neodash env)
• After apply: verify DNS records are updated for new keboola.systems zone
• After apply: verify SSL certs provision successfully for new domains
• Verify https://kb.keboola.systems and neo4j.keboola.systems are reachable

[linear]

ST-3586 Switch manano apps to new domain