refactor(kb): rename default S3 bucket to legal-kb (was insurance-kb)

The bucket name was a holdover from the original single-domain
prototype (Israeli National Insurance only). With multi-topic support
the same bucket now hosts files for ביטוח לאומי, דיני עבודה, פלילי,
and any future legal domains — separated by `inbox/<topic_slug>/`
prefix, not by bucket. Generic `legal-kb` name reflects that.

Only the default in `_bucket()` changes; deployments that already set
`KB_S3_BUCKET` are unaffected. Dev was migrated to `legal-kb` in the
same operation (`mc mirror` of all 221 objects, env var update,
UPDATE on `kb_source.original_path` rewriting `s3://insurance-kb/` →
`s3://legal-kb/`). Prod MinIO has the empty `legal-kb` bucket ready
for shira-hermes prod cutover.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/services/kb/s3.py

@@ -1,4 +1,4 @@
-"""MinIO/S3 helpers for the insurance-kb bucket.
+"""MinIO/S3 helpers for the shared kb bucket (formerly `insurance-kb`).
 
 Layout in the bucket:
     inbox/{law,regulation,circular,caselaw,tool}/<file>
@@ -41,7 +41,7 @@ def _client():
 
 
 def _bucket() -> str:
-    return os.environ.get("KB_S3_BUCKET", "insurance-kb")
+    return os.environ.get("KB_S3_BUCKET", "legal-kb")
 
 
 def list_inbox() -> list[dict]: