Pin the pushed server image; drop the pull secret

mg4-server:2.0.0 is on git.stinnesbeck.com and pulls anonymously, so
the Deployment no longer references a registry pull secret. The image
is pinned by digest (sha256:6feea777…) so a re-pushed tag cannot
change what the cluster runs. README and secrets template updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/kustomization.yaml

@@ -10,7 +10,8 @@ resources:
   - ingress.yaml
 images:
   - name: git.stinnesbeck.com/nils/mg4-server
-    newTag: "2.0.0"
+    # 2.0.0, pinned by digest so a re-pushed tag cannot change what runs.
+    digest: sha256:6feea777c514b9488ffb0b49fad7c15423ee06f0e0e8d609cf31eb85755da815
 generatorOptions:
   labels:
     app.kubernetes.io/part-of: mg4