Pin the pushed server image; drop the pull secret

mg4-server:2.0.0 is on git.stinnesbeck.com and pulls anonymously, so
the Deployment no longer references a registry pull secret. The image
is pinned by digest (sha256:6feea777…) so a re-pushed tag cannot
change what the cluster runs. README and secrets template updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -37,7 +37,8 @@ car ──live telemetry───▶ car.stinnesbeck.com (Go) ──▶ ABRP  ap
       idempotency, all 25 dashboard queries return data, dashboards rendered and checked.
 - [x] Manifests validated offline (including Traefik CRDs). **Not applied.**
 - [x] Car app 2.3.0: unit tests and lint pass; **not yet tried on the car**.
-- [ ] Push the image (`mg4-server:2.0.0`) to git.stinnesbeck.com (needs a registry login here).
+- [x] Image `mg4-server:2.0.0` pushed to git.stinnesbeck.com (public; pinned by digest
+      `sha256:6feea777…` in `k8s/kustomization.yaml`).
 - [ ] Check in `k8s/ingress.yaml`: the Traefik ingress class (placeholder `traefik-external`) and
       Grafana's host (placeholder `car-grafana.stinnesbeck.com`).
 - [ ] First drive with 2.3.0: telemetry arrives in InfluxDB, Grafana and ABRP.