fix(prod): switch litellm-proxy imagePullPolicy to Always

Argo CD's bundled kustomize doesn't seem to honor the `digest:` field
in the images transformer for prod, so pinning to a sha256 digest in
overlays/prod/kustomization.yaml has no effect at apply time and the
deployment keeps the bare `:aihpi-provider` tag. With pullPolicy
IfNotPresent, kubelet skips pulling the cached image, so prod was
stuck on a stale build.

Switch to Always so pod restarts always pull the latest aihpi-provider
build. Trade-off: loses reproducibility from the manifest (image is
tag-resolved at pull time) and prod can't start pods if the registry
is unreachable, but this is acceptable given staging is validated
against the same tag first.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: felixboelter

overlays/prod/patches/litellm-prod.yaml

@@ -14,7 +14,7 @@ spec:
         node-type: cpu
       containers:
         - name: litellm
-          imagePullPolicy: IfNotPresent
+          imagePullPolicy: Always
           readinessProbe:
             httpGet:
               path: /litellm/.well-known/litellm-ui-config