Pin the pushed server image; drop the pull secret

mg4-server:2.0.0 is on git.stinnesbeck.com and pulls anonymously, so
the Deployment no longer references a registry pull secret. The image
is pinned by digest (sha256:6feea777…) so a re-pushed tag cannot
change what the cluster runs. README and secrets template updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/server.yaml

@@ -21,9 +21,6 @@ spec:
         app.kubernetes.io/name: mg4-server
         app.kubernetes.io/part-of: mg4
     spec:
-      # Needed only if the image is private on git.stinnesbeck.com; see secrets.example.yaml.
-      imagePullSecrets:
-        - name: git-stinnesbeck-registry
       securityContext:
         runAsNonRoot: true
         runAsUser: 65532