feat: support image digest pinning for server and database images

[slauger]

Summary

Add image digest pinning for the server and database images, so openvox-stack
deployments can pin by immutable digest, not just by tag.

Split out of #478 (comment #478 (comment)).
The version-tag half of #478 is resolved (the charts default the image tag to the
chart version as of 0.9.7, #479). Digest pinning is the remaining piece and needs a
CRD + controller change, so it gets its own issue.

Why the chart alone can't do it

openvox-stack writes config.image and database.image into the Config and
Database CRDs. Their image spec is the shared ImageSpec
(api/v1alpha1/config_types.go), which only has repository, tag, pullPolicy
and pullSecrets -- there is no digest field for the chart to write into.

Image references are also built as repository:tag in two places:

• internal/controller/helpers.go resolveImage (Server/Config images)
• internal/controller/database_deployment.go (db.Spec.Image)

So a digest can't be expressed by the CRD or honoured by the controller today.

(The openvox-operator chart already supports image.digest because it renders a
Deployment directly, not via a CRD -- that's the pattern to mirror.)

Proposed change

1. CRD: add digest to ImageSpec:

   // Digest pins the image by content digest (sha256:...). Takes precedence over Tag.
   // +kubebuilder:validation:Pattern=`^sha256:[a-f0-9]{64}$`
   // +optional
   Digest string `json:"digest,omitempty"`

   This covers both Config.spec.image (server) and Database.spec.image.
2. Controller: build repository@digest when digest is set (digest wins over
   tag), in resolveImage and the Database deployment builder. Add a small shared
   helper so both use identical logic.
3. Chart: expose config.image.digest and database.image.digest in
   openvox-stack (mirroring the openvox-operator chart's image.digest, which
   takes precedence over tag). Keep the Server override (servers[].image) in
   sync.
4. Regenerate CRDs, values schema and README; add unit/helm tests and docs.

Acceptance criteria

• ImageSpec.digest added and validated (sha256:<64 hex>).
• resolveImage and the Database builder emit repo@digest when set, tag
  otherwise; digest takes precedence.
• openvox-stack exposes config.image.digest and database.image.digest.
• CRDs/schema/README regenerated; controller + helm tests; docs updated.

Follow-up to #478.