Roll back Authelia to pinned 4.38 after 4.39.28 broke KeyCape token exchange

4.39 rejects KeyCape's in-cluster http back-channel token call
(invalid X-Forwarded-Proto 'http'). Operator restored the pre-upgrade DB
and the 4.38 digest; incident recorded in NK-WP-0041-T02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

sso-mfa/k8s/authelia/deployment.yaml

@@ -45,7 +45,7 @@ spec:
       containers:
         - name: authelia
           # Pin to a specific 4.x release. Check https://hub.docker.com/r/authelia/authelia
-          image: docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54  # v4.39.28
+          image: docker.io/authelia/authelia@sha256:46021dc20efdcc5cdc38a29e3050b8835429a155ae6215388ed3b793a02eb0ab  # 4.38 (rolled back from 4.39.28, NK-WP-0041-T02)
           imagePullPolicy: IfNotPresent
 
           ports: