fix(minio): pin frozen community image and alert on image pull failure

MinIO deleted the community edition images upstream. An anonymous pull of
docker.io/minio/minio and quay.io/minio/mc returns HTTP 401, and the Docker Hub
API returns "object not found". talos-cp-1 dropped the cached image during the
DiskPressure event on 2026-09-22. The tenant pod was recreated on 2026-09-23 and
has been in ImagePullBackOff since. MinIO served no traffic for 13 days, which
put vault-0 and loki-0 into CrashLoopBackOff and left the paperless backups
stuck.

Pin the tenant to the last community release by digest, and repoint the two
minio/mc references at the archived Bitnami client image, also by digest. Alert
on ImagePullBackOff and on a pod that stays not ready, because neither case
raised any alert.

Refs: httphub.docker.io/v2/repositories/minio/minio/tags -> {"message":"object not found"}

k8s/apps/paperless/backup-cronjob.yaml

@@ -48,7 +48,7 @@ spec:
                   mountPath: /backup
           containers:
             - name: mc-mirror
-              image: quay.io/minio/mc:latest
+              image: docker.io/bitnamilegacy/minio-client:2025.7.21-debian-12-r3@sha256:73bd39f7899a0cef12b8dd5df13aa93a3ed1aaa44236542442e9ac76819ac158
               env:
                 - name: ACCESS_KEY
                   valueFrom: