fix(demo-service): move imagePullSecrets to pod-level

K8s ignores imagePullSecrets at container-level; it must be at pod spec level.
This is why the pull was failing with 401.

home-apps/demo-service.yaml

@@ -110,10 +110,8 @@ spec:
         - name: api
           # Image is updated automatically by .github/workflows/build-demo-service.yml
           # on every push that changes home-apps/demo-service/**
-          image: ghcr.io/wahyd4/demo-manager:git-cbb50ac
+          image: ghcr.io/wahyd4/demo-manager:PLACEHOLDER
           imagePullPolicy: Always
-          imagePullSecrets:
-            - name: github-image-pull-secret
           ports:
             - containerPort: 3000
               name: api
@@ -135,6 +133,9 @@ spec:
               memory: 256Mi
               cpu: 500m
 
+      imagePullSecrets:
+        - name: github-image-pull-secret
+
       volumes:
         - name: caddy-config
           configMap: