fix(kanidm): use dockerhub image instead of ghcr.io (#161)

## Summary

- Changes both `config-init` init container and `kanidm` container images from `ghcr.io/kanidm/server:1.10.3` to `kanidm/server:1.10.3`

## Why

`kanidm/server` is published on Docker Hub, not ghcr.io. RKE2 rewrites dockerhub pulls through the artifactapi mirror automatically.

## Test plan

- [ ] Pods roll successfully after ArgoCD sync
- [ ] Verify kanidm cluster replication still healthy

Reviewed-on: #161

apps/base/kanidm/statefulset.yaml

@@ -36,7 +36,7 @@ spec:
         fsGroup: 1000
       initContainers:
         - name: config-init
-          image: ghcr.io/kanidm/server:1.10.3
+          image: kanidm/server:1.10.3
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -99,7 +99,7 @@ spec:
             readOnlyRootFilesystem: false
       containers:
         - name: kanidm
-          image: ghcr.io/kanidm/server:1.10.3
+          image: kanidm/server:1.10.3
           command: ["/sbin/kanidmd"]
           args: ["server", "-c", "/config/server.toml"]
           ports: