Fix push auth: drop harbor-robot-dockerconfig mount, use admin login

Mirror push failed "unauthorized to access repository: base-images/
golang, action: push" — harbor-robot-dockerconfig is scoped only to
the homelab project's robot account, nothing on base-images. Making
base-images public only grants anonymous pull, never push. Removed
the read-only docker-config secret mount (it would have blocked
`docker login` from writing new credentials anyway) and switched to
logging in interactively with Harbor admin credentials instead, since
this whole mirror is a rarely-run manual task, not worth provisioning
a dedicated robot account for.

README.md

@@ -93,9 +93,6 @@ spec:
       volumeMounts:
         - name: mirror
           mountPath: /mirror
-        - name: docker-config
-          mountPath: /root/.docker
-          readOnly: true
   volumes:
     - name: docker-graph-storage
       emptyDir: {}
@@ -103,17 +100,29 @@ spec:
       configMap:
         name: base-images-mirror
         defaultMode: 0755
-    - name: docker-config
-      secret:
-        secretName: harbor-robot-dockerconfig
-        items:
-          - key: .dockerconfigjson
-            path: config.json
 EOF
+```
 
+**No `harbor-robot-dockerconfig` mount here on purpose** — that robot
+account is scoped only to the `homelab` project (push+pull there
+specifically); it has no grant on `base-images` at all, and making
+`base-images` public only grants anonymous *pull*, never push. Push
+always needs real credentials scoped to that project regardless. For a
+one-off manual task like this, simplest is just logging in with your
+Harbor admin account directly inside the pod, rather than provisioning
+a whole new robot account for something run this rarely:
+
+```
 kubectl wait --for=condition=Ready pod/base-images-mirror -n jenkins --timeout=120s
-kubectl exec -n jenkins base-images-mirror -c docker-cli -- sh -c '
+kubectl exec -it -n jenkins base-images-mirror -c docker-cli -- sh -c '
   for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
+  docker login harbor.192.168.1.7.nip.io
+'
+```
+(enter your Harbor admin username/password when prompted)
+
+```
+kubectl exec -n jenkins base-images-mirror -c docker-cli -- sh -c '
   cd /mirror && sh mirror.sh
 '
 kubectl delete pod base-images-mirror -n jenkins