chore(submodules): move 4 SSH-URL submodules to HTTPS (Phase 3)

Switch smom-dbis-138, metamask-integration, dbis_core, the-order from
git@github.com: SSH URLs to https:// URLs so git submodule update --init
works in HTTPS-only environments (CI containers, Devin agents, etc.).

Per AGENTS.md, the canonical source is Gitea, so prefer gitea.d-bis.org
where the currently-pinned commit is actually reachable:

- smom-dbis-138      -> gitea.d-bis.org/d-bis/smom-dbis-138      (Gitea only)
- metamask-integration -> gitea.d-bis.org/d-bis/metamask-integration (Gitea + GitHub)
- dbis_core          -> github.com/Order-of-Hospitallers/dbis_core (GitHub only; Gitea mirror lags)
- the-order          -> github.com/Order-of-Hospitallers/the-order-monorepo (no Gitea mirror)

Reachability of each pinned commit verified 2026-04-18 via git ls-remote
and shallow fetch. Documented the full remote-status matrix and follow-up
migration candidates (dbis_core, the-order, omada-api, pr-workspace/*) in
docs/00-meta/SUBMODULE_HYGIENE.md.

No submodule pointers changed; this is remote-URL-only.

Tracking: #1
Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

.gitmodules

@@ -7,16 +7,22 @@
 	url = https://github.com/gilby125/mcp-proxmox.git
 [submodule "smom-dbis-138"]
 	path = smom-dbis-138
-	url = git@github.com:Order-of-Hospitallers/smom-dbis-138.git
+	url = https://gitea.d-bis.org/d-bis/smom-dbis-138.git
+	# Canonical = Gitea. Pinned commit exists on Gitea only (verified 2026-04-18).
 [submodule "ProxmoxVE"]
 	path = ProxmoxVE
 	url = https://gitea.d-bis.org/d-bis/ProxmoxVE.git
 [submodule "metamask-integration"]
 	path = metamask-integration
-	url = git@github.com:Defi-Oracle-Meta-Blockchain/metamask-integration.git
+	url = https://gitea.d-bis.org/d-bis/metamask-integration.git
+	# Canonical = Gitea. Pinned commit fetchable from both Gitea and
+	# github.com/Defi-Oracle-Meta-Blockchain/metamask-integration (verified 2026-04-18).
 [submodule "dbis_core"]
 	path = dbis_core
-	url = git@github.com:Order-of-Hospitallers/dbis_core.git
+	url = https://github.com/Order-of-Hospitallers/dbis_core.git
+	# TODO: migrate to gitea.d-bis.org/d-bis/dbis_core once the Gitea mirror
+	# catches up — pinned commit is currently reachable only via GitHub
+	# (verified 2026-04-18). Switched from SSH to HTTPS to unblock HTTPS-only envs.
 [submodule "defi-arbitrage"]
 	path = dbis_core/src/core/defi/arbitrage
 	url = https://gitea.d-bis.org/d-bis/defi-arbitrage.git
@@ -36,7 +42,10 @@
 	path = omada-api
 	url = https://github.com/ARROMIS/omada-api.git
 	# Note: This is a workspace package that was tracked as a submodule.
-	# If this repository doesn't exist, consider converting to a regular workspace package.
+	# The GitHub repo currently returns 403 from HTTPS-only environments (verified
+	# 2026-04-18). Pinned commit 18a4e508 may be unreachable. Candidate for
+	# conversion to a regular workspace package or removal — tracked in
+	# docs/00-meta/SUBMODULE_HYGIENE.md.
 [submodule "pr-workspace/app-ethereum"]
 	path = pr-workspace/app-ethereum
 	url = https://github.com/defiQUG/app-ethereum.git
@@ -45,7 +54,10 @@
 	url = https://github.com/defiQUG/chains.git
 [submodule "the-order"]
 	path = the-order
-	url = git@github.com:Order-of-Hospitallers/the-order-monorepo.git
+	url = https://github.com/Order-of-Hospitallers/the-order-monorepo.git
+	# TODO: migrate to Gitea once a mirror exists. gitea.d-bis.org/d-bis/the-order
+	# is a DIFFERENT repo; the pinned commit is only reachable on GitHub
+	# (verified 2026-04-18). Switched from SSH to HTTPS to unblock HTTPS-only envs.
 [submodule "arromis-monorepo"]
 	path = arromis-monorepo
 	url = https://github.com/ARROMIS/arromis-monorepo.git

docs/00-meta/SUBMODULE_HYGIENE.md

@@ -1,6 +1,6 @@
 # Submodule and explorer remote hygiene
 
-**Last Updated:** 2026-03-27  
+**Last Updated:** 2026-04-18
 **Purpose:** Operational notes for the many git submodules under the proxmox parent repo: detached HEAD, remotes, pushes, and non-secret JSON env snapshots.
 
 ---
@@ -60,7 +60,50 @@ git remote add origin https://gitea.d-bis.org/d-bis/explorer-monorepo.git
 
 ## metamask-integration upstream
 
-This clone may show `main...gitea/main` when **Gitea** is the configured `origin` or tracking remote. Confirm with your team whether **GitHub** (see `.gitmodules`) or **Gitea** is canonical for pushes; align `branch.<name>.remote` if both exist.
+`.gitmodules` now points to **Gitea** (`https://gitea.d-bis.org/d-bis/metamask-integration.git`) — canonical per AGENTS.md, and the pinned commit is reachable on both Gitea and the GitHub mirror at `Defi-Oracle-Meta-Blockchain/metamask-integration` (verified 2026-04-18). For contributions, push to Gitea; align `branch.<name>.remote` if local clones still have GitHub as `origin`.
+
+---
+
+## Submodule remote status matrix (verified 2026-04-18)
+
+Regen with `bash scripts/verify/submodules-clean.sh` or re-run the Phase 3 reachability check in `.gitea/workflows/submodules-check.yml`. "Pinned commit reachable" means the commit recorded in the parent `master` is fetchable from the listed remote.
+
+| Submodule | `.gitmodules` URL | Pinned commit reachable on | Notes |
+|---|---|---|---|
+| explorer-monorepo | gitea.d-bis.org/d-bis/explorer-monorepo | Gitea (canonical) | — |
+| ProxmoxVE | gitea.d-bis.org/d-bis/ProxmoxVE | Gitea (canonical) | — |
+| defi-arbitrage | gitea.d-bis.org/d-bis/defi-arbitrage | Gitea (canonical) | nested under dbis_core |
+| fireblocks-integration | gitea.d-bis.org/d-bis/fireblocks-integration | Gitea (canonical) | — |
+| cross-chain-pmm-lps | gitea.d-bis.org/d-bis/cross-chain-pmm-lps | Gitea (canonical) | — |
+| ai-mcp-pmm-controller | gitea.d-bis.org/d-bis/ai-mcp-pmm-controller | Gitea (canonical) | — |
+| MEV_Bot | gitea.d-bis.org/d-bis/MEV_Bot | Gitea (canonical) | — |
+| **smom-dbis-138** | gitea.d-bis.org/d-bis/smom-dbis-138 | **Gitea only** | Switched from `git@github.com:` SSH. Pinned commit NOT on `Order-of-Hospitallers/smom-dbis-138` GitHub. |
+| **metamask-integration** | gitea.d-bis.org/d-bis/metamask-integration | Gitea + GitHub | Switched from `git@github.com:` SSH. |
+| **dbis_core** | github.com/Order-of-Hospitallers/dbis_core | GitHub only | Switched from `git@github.com:` SSH. Gitea mirror exists but is behind; migrate once caught up. |
+| **the-order** | github.com/Order-of-Hospitallers/the-order-monorepo | GitHub only | Switched from `git@github.com:` SSH. `gitea.d-bis.org/d-bis/the-order` is a DIFFERENT repo — do not point at it. |
+| mcp-proxmox | github.com/gilby125/mcp-proxmox | GitHub | third-party, no Gitea plan |
+| gru-docs | github.com/Defi-Oracle-Tooling/GRU-Official-Docs-Monetary-Policies | GitHub | tracking `docs-review-fixes` branch |
+| miracles_in_motion | github.com/Order-of-Hospitallers/miracles_in_motion | GitHub | no Gitea mirror today |
+| metaverseDubai | github.com/Order-of-Hospitallers/metaverseDubai | GitHub | no Gitea mirror today |
+| OMNIS | github.com/Defi-Oracle-Tooling/OMNIS | GitHub | no Gitea mirror today |
+| arromis-monorepo | github.com/ARROMIS/arromis-monorepo | GitHub | no Gitea mirror today |
+| alltra-lifi-settlement | github.com/bis-innovations/LiFi_Pay_Alltra_Integration_Submodule | GitHub | no Gitea mirror today |
+| pr-workspace/app-ethereum | github.com/defiQUG/app-ethereum | GitHub (personal fork) | candidate for removal |
+| pr-workspace/chains | github.com/defiQUG/chains | GitHub (personal fork) | candidate for removal |
+| **omada-api** | github.com/ARROMIS/omada-api | — (403 from HTTPS-only envs 2026-04-18) | Candidate for conversion to regular workspace package or removal. `pnpm-workspace.yaml` already has a compatibility note. |
+
+### Phase 3 scope (this round)
+
+- Moved 4 SSH-URL submodules to HTTPS (`smom-dbis-138`, `metamask-integration`, `dbis_core`, `the-order`), preferring Gitea where the pinned commit is reachable there. Verified each `git submodule update --init` succeeds from a clean checkout.
+- Documented `omada-api` unreachability without changing its pointer — removal or workspace-package conversion is a separate decision.
+- Left the 10 submodules already on Gitea or non-SSH GitHub untouched.
+
+### Follow-up candidates (not in this PR)
+
+1. `dbis_core` — migrate to Gitea once the `d-bis/dbis_core` mirror catches up to the pinned commit. Today it lags HEAD by a different commit graph, so pointing there would break `git submodule update --init`.
+2. `the-order` — no Gitea mirror of `the-order-monorepo` yet; decide whether to host one at `d-bis/the-order-monorepo`.
+3. `omada-api` — repo gone / private; remove the submodule or convert to a vendored workspace package.
+4. `pr-workspace/app-ethereum` and `pr-workspace/chains` — personal forks under `defiQUG/`; review whether these belong in the monorepo at all.
 
 ---