ghp: use direct ghcr.io image + set GHP_ADMINS

Kubelet pulls hit ImagePullBackOff on the artifactapi ghcr pull-through
because ghcr.io's per-scope token auth is not proxied for anonymous
pulls. Switch the serve Deployment and migrate Job to the direct public
image (pulls anonymously) and set the admin to neoloc.

- deployment.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- migrate-job.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- configmap.yaml: GHP_ADMINS -> neoloc

apps/base/ghp/configmap.yaml

@@ -19,4 +19,4 @@ data:
   GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
   GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
   # PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
-  GHP_ADMINS: "REPLACE_ME_ben_github_username"
+  GHP_ADMINS: "neoloc"

apps/base/ghp/deployment.yaml

@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.

apps/base/ghp/migrate-job.yaml

@@ -37,7 +37,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
+          image: ghcr.io/goodtune/ghp:0.20.0
           imagePullPolicy: IfNotPresent
           command: ["/ghp", "migrate"]
           env: