fix(kanidm): use dockerhub image instead of ghcr.io

kanidm/server is on Docker Hub; ghcr.io requires auth. RKE2 rewrites
dockerhub pulls through the artifactapi mirror automatically.

apps/base/kanidm/statefulset.yaml

@@ -36,7 +36,7 @@ spec:
         fsGroup: 1000
       initContainers:
         - name: config-init
-          image: ghcr.io/kanidm/server:1.10.3
+          image: kanidm/server:1.10.3
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -99,7 +99,7 @@ spec:
             readOnlyRootFilesystem: false
       containers:
         - name: kanidm
-          image: ghcr.io/kanidm/server:1.10.3
+          image: kanidm/server:1.10.3
           command: ["/sbin/kanidmd"]
           args: ["server", "-c", "/config/server.toml"]
           ports: