fix(artifactapi): move kanidm to dockerhub remote (#160)

## Summary

- Removes `^kanidm/` from the `ghcr` remote immutable_patterns
- Adds `^kanidm/` to the `dockerhub` remote immutable_patterns

## Why

`kanidm/server` is published on Docker Hub, not ghcr.io. Pulling via the `ghcr` cache was failing with 403 on anonymous token fetch → 502 Bad Gateway.

## Test plan

- [ ] `docker pull artifactapi.k8s.syd1.au.unkin.net/dockerhub/kanidm/server:1.10.3` succeeds after artifactapi redeploys

Reviewed-on: #160

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,7 +6,6 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
-      - "^kanidm/"
       - "^openvoxproject/"
       - "^stakater/reloader"
       - "^stalwartlabs/stalwart"
@@ -35,6 +34,7 @@ remotes:
       - "^hashicorp/consul"
       - "^hashicorp/vault"
       - "^jfrog/"
+      - "^kanidm/"
       - "^rancher/"
       - "^rspamd/rspamd"
       - "^tozd/postfix"