plotting-book: pull image from private ghcr instead of public DockerHub

Anca's plotting-book app now builds its image in her own GitHub repo to
the private package ghcr.io/passionprojectsanca/book-plotter (off public
DockerHub viktorbarzin/book-plotter). Wire the cluster to pull it:

- stacks/plotting-book: point the deployment baseline image at the ghcr
  package and add imagePullSecrets {ghcr-credentials} so the pod can pull
  the private image (the live tag is still CI-owned via ignore_changes).
- stacks/kyverno: add the plotting-book namespace to the ghcr-credentials
  allowlist so the Kyverno generate policy clones the pull secret into it.
  Verified the shared ghcr_pull_token (Viktor, repo-admin on Anca's repo)
  can read the private package before wiring this.

Docs: correct ci-cd.md (it wrongly listed plotting-book as already on
ghcr — it was on DockerHub) and note the special arrangement; amend
ADR-0003 to record that this GitHub-first repo builds to its own org's
ghcr namespace.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/kyverno/modules/kyverno/ghcr-credentials.tf

@@ -34,6 +34,10 @@ locals {
     # goldmane-edge-aggregator: PRIVATE ghcr image pulled by the aggregate
     # Deployment + digest CronJob (ADR-0014, infra#58).
     "goldmane-edge-aggregator",
+    # plotting-book: image migrated from public DockerHub to PRIVATE
+    # ghcr.io/passionprojectsanca/book-plotter (built by GHA in Anca's repo,
+    # under her own org's ghcr). The deployment references the cloned secret.
+    "plotting-book",
   ]
 }