fleet-manager: pull non-CI images through the Harbor mirror

Route the ad-hoc images I introduced through harbor.bitasylum.org (the standing
rule): backup.sh uses harbor.bitasylum.org/dockerhub/library/alpine:3.20 (via an
overridable ALPINE_IMAGE); the DEPLOY.md volume-chown fix + the goacme/lego prose
use the Harbor paths too. Compose (influxdb/traefik) + Dockerfile bases are already
harbor-mirrored; git.bitasylum.org/audiobuzz/* stays (CI-built).

serving/fleet-manager/DEPLOY.md

@@ -151,7 +151,8 @@ also keeps the WebAuthn secure-context clean.
 
 > **Self-TLS alternative (no Traefik):** set `FLEET_MGR_ADMIN_BEHIND_PROXY=false`
 > and give the manager a cert at `/pki/admin/{fullchain,privkey}.pem` (e.g. via the
-> `acme/renew-loop.sh` helper under a `goacme/lego` container). The manager then
+> `acme/renew-loop.sh` helper under a `harbor.bitasylum.org/dockerhub/goacme/lego`
+> container). The manager then
 > terminates TLS itself and the origin includes the port it listens on.
 
 <a name="network-paths"></a>
@@ -251,7 +252,7 @@ If you run compose under a non-default project name, pass
   once:
   ```bash
   docker volume ls | grep fleet          # find the name, e.g. fleet-manager_fleet-data
-  docker run --rm -v <vol>:/data alpine chown -R 65532:65532 /data
+  docker run --rm -v <vol>:/data harbor.bitasylum.org/dockerhub/library/alpine:3.20 chown -R 65532:65532 /data
   ```
 - **`authorise plane not configured (no enrol-broker wired)` in the SPA** — the
   manager has the pillar disabled (`s.broker == nil`). Check