ArgoCD diffs against live state where k8s defaults these fields in:
- parentRefs: group=gateway.networking.k8s.io, kind=Gateway
- backendRefs: group="", kind=Service, weight=1
Matches the pattern from #153 (certificateRefs).
## Summary
- Changes both `config-init` init container and `kanidm` container images from `ghcr.io/kanidm/server:1.10.3` to `kanidm/server:1.10.3`
## Why
`kanidm/server` is published on Docker Hub, not ghcr.io. RKE2 rewrites dockerhub pulls through the artifactapi mirror automatically.
## Test plan
- [ ] Pods roll successfully after ArgoCD sync
- [ ] Verify kanidm cluster replication still healthy
Reviewed-on: #161