priority-pass: backend c2b4ac50 — crop to card before transforming

Three fixes for boarding passes uploaded as iPhone screenshots (input
includes phone status bar, partial Tesco card below, etc.):

1. Detect the card region first and crop to it. All proportional
   coordinates (Step 8 text replacement, Step 9 logo removal) are now
   card-relative instead of full-image-relative — they were landing
   in the wrong region on tall screenshots, putting "Priority" text
   inside the QR area and leaving a yellow icon box at the bottom.

2. Step 8 now picks the LONGEST contiguous dark-row run inside a wider
   y-band, instead of using the dark-row [first, last] span. This
   distinguishes the QUEUE value text from the QUEUE label above it
   (both are dark blue in the original) so the erase rectangle no
   longer eats into the labels.

3. QR container padding bumped 8% → 12% so QR/container ratio matches
   the ~74-80% golden look.

Verified end-to-end against three real samples saved by the previous
build's training-data feature, plus the original non-priority.jpeg
fixture: outputs now match priority.jpeg layout.

[ci skip]

stacks/authentik/authentik_provider.tf

@@ -65,15 +65,6 @@ resource "authentik_provider_proxy" "catchall" {
 # in authentik 2026.2.x — UserLoginStage is the correct knob.
 # -----------------------------------------------------------------------------
 
-data "authentik_stage" "default_authentication_login" {
-  name = "default-authentication-login"
-}
-
-import {
-  to = authentik_stage_user_login.default_login
-  id = data.authentik_stage.default_authentication_login.id
-}
-
 resource "authentik_stage_user_login" "default_login" {
   name             = "default-authentication-login"
   session_duration = "weeks=4"

stacks/priority-pass/main.tf

@@ -104,7 +104,7 @@ resource "kubernetes_deployment" "priority-pass" {
         }
         container {
           name  = "backend"
-          image = "registry.viktorbarzin.me/priority-pass-backend:f4246691"
+          image = "registry.viktorbarzin.me/priority-pass-backend:c2b4ac50"
           port {
             container_port = 8000
           }