refactor: extract DEFAULT_IMAGE_TAG constant — the 9-way duplication makes default-version bumps error-prone

[jensens]

What

The Mailu image tag default '2024.06.47' is hardcoded 9 separate times across the construct files, plus once in a JSDoc:

src/constructs/admin-construct.ts:74:      image: `${config.images?.registry || 'ghcr.io/mailu'}/admin:${config.images?.tag || '2024.06.47'}`,
src/constructs/clamav-construct.ts:76:      image: `${config.images?.registry || 'ghcr.io/mailu'}/clamav:${config.images?.tag || '2024.06.47'}`,
src/constructs/dovecot-construct.ts:75:      image: `${config.images?.registry || 'ghcr.io/mailu'}/dovecot:${config.images?.tag || '2024.06.47'}`,
src/constructs/fetchmail-construct.ts:61:      image: `${config.images?.registry || 'ghcr.io/mailu'}/fetchmail:${config.images?.tag || '2024.06.47'}`,
src/constructs/front-construct.ts:66:      image: `${config.images?.registry || 'ghcr.io/mailu'}/nginx:${config.images?.tag || '2024.06.47'}`,
src/constructs/postfix-construct.ts:75:      image: `${config.images?.registry || 'ghcr.io/mailu'}/postfix:${config.images?.tag || '2024.06.47'}`,
src/constructs/rspamd-construct.ts:201:     image: `${config.images?.registry || 'ghcr.io/mailu'}/rspamd:${config.images?.tag || '2024.06.47'}`,
src/constructs/webdav-construct.ts:74:      image: `${config.images?.registry || 'ghcr.io/mailu'}/radicale:${config.images?.tag || '2024.06.47'}`,
src/constructs/webmail-construct.ts:78:      image: `${config.images?.registry || 'ghcr.io/mailu'}/webmail:${config.images?.tag || '2024.06.47'}`,
src/config.ts:322:   * @default "2024.06.47"

Same story for the registry default 'ghcr.io/mailu'.

Users who set images.tag in their config (i.e. anyone running a pinned version like we do in production) are unaffected — the defaults only kick in when the prop is left undefined. But:

1. When a default-version bump is wanted (e.g. .47 → .51 in our case today), it requires a 9-way string replace plus the JSDoc, plus updating snapshot tests, with the risk of missing one and producing a Mailu cluster running mixed image versions across components.
2. New downstream users picking up the latest cdk8s-mailu without explicit pinning silently get whatever stale tag was last edited into 9 places.

Proposed

Tidy-First, no behavior change:

1. Extract a single shared constant, e.g. in src/config.ts or a new src/defaults.ts:

   /** Default Mailu image tag — bumped per cdk8s-mailu release to a known-good Mailu version. */
   export const DEFAULT_MAILU_IMAGE_TAG = '2024.06.47';
   /** Default Mailu image registry. */
   export const DEFAULT_MAILU_IMAGE_REGISTRY = 'ghcr.io/mailu';

2. All 9 constructs reference the constant:

   image: `${config.images?.registry || DEFAULT_MAILU_IMAGE_REGISTRY}/admin:${config.images?.tag || DEFAULT_MAILU_IMAGE_TAG}`,

3. JSDoc on ImageConfig.tag references the constant in its @default so Projen-friendly docs reflect a single source of truth.
4. Optional: snapshot test that asserts every Deployment in a default-config synth uses the same image tag, so a future partial edit can't silently slip through.

Bonus follow-up (separate issue if not done here)

Once the constant exists, RspamdConstruct startup-probe failureThreshold: 3 (= 30s startup window) tends to fail on 2024.06.51 — rspamd needs 40-50s for hyperscan + Lua + redis-script-upload init, so the pod CrashLoops several times before eventually starting. Bumping the constant default would expose this more frequently. Worth raising the probe tolerance at the same time.

Compat

No public API changes. Default value stays '2024.06.47' after the refactor (separate PR can bump it). Users that explicitly set images.tag are unaffected.

Discovered while

Bumping a downstream consumer (kup6s/dp-infra) from 2024.06.47 to 2024.06.51. Worked fine because we pin explicitly, but the diff in cdk8s-mailu for the same bump would touch 9 files vs the desired 1.