revert(contabo): pin catalyst-{api,ui} to :8a1fe04 — :ed8872a CrashLoops k8scache

PR #977's auto-deploy step bumped contabo's Kustomize-path image refs
to :ed8872a, which contains PR #975's k8scache startup probe that
synchronously discovers each registered Sovereign at boot. With contabo
holding 14 per-Sovereign kubeconfigs (some pointing at wiped Hetzner
servers), the discovery loop blocks past the readiness probe deadline
and the catalyst-api pod CrashLoops indefinitely.

Roll contabo back to :8a1fe04 — the last image without the k8scache
startup probe — to restore login + wizard. Sovereigns are unaffected
(they install via OCI chart whose values.yaml is correctly pinned).

Once a fix lands for the k8scache startup probe (separate session),
operators will manually re-pin contabo to the validated fixed SHA per
the policy established in PR #980.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

products/catalyst/chart/templates/api-deployment.yaml

@@ -152,7 +152,7 @@ spec:
         fsGroupChangePolicy: OnRootMismatch
       containers:
         - name: catalyst-api
-          image: "ghcr.io/openova-io/openova/catalyst-api:ed8872a"
+          image: "ghcr.io/openova-io/openova/catalyst-api:8a1fe04"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

products/catalyst/chart/templates/ui-deployment.yaml

@@ -19,7 +19,7 @@ spec:
         - name: ghcr-pull
       containers:
         - name: catalyst-ui
-          image: "ghcr.io/openova-io/openova/catalyst-ui:ed8872a"
+          image: "ghcr.io/openova-io/openova/catalyst-ui:8a1fe04"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080