kms: image base forgejo registry -> ghcr (ADR-0002 infra#21)

kms-website moves off in-cluster Woodpecker builds to GHA -> ghcr.
The kms-web-page deployment image is ignore_changes'd (CI sets the live
tag), so this repoint only governs future creates; package is PUBLIC so
no pull secret is wired. No CronJobs in this stack.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/kms/main.tf

@@ -54,7 +54,7 @@ resource "kubernetes_deployment" "kms-web-page" {
           name = "registry-credentials"
         }
         container {
-          image             = "forgejo.viktorbarzin.me/viktor/kms-website:${var.image_tag}"
+          image             = "ghcr.io/viktorbarzin/kms-website:${var.image_tag}"
           name              = "kms-web-page"
           image_pull_policy = "IfNotPresent"
           resources {

stacks/kms/variables.tf

@@ -1,5 +1,5 @@
 variable "image_tag" {
   type        = string
   default     = "latest"
-  description = "kms-website image tag pushed to forgejo.viktorbarzin.me/viktor/kms-website. Use 8-char git SHA in CI."
+  description = "kms-website image tag pushed to ghcr.io/viktorbarzin/kms-website (ADR-0002 off-infra builds). Use 8-char git SHA in CI."
 }