Remove tag = "latest" from nix container definitions

The tag field in buildLayeredImage is optional and only affects the
local docker-archive output. The CI workflow tags with immutable
SHA-based tags via skopeo, so "latest" is misleading noise.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

containers/alloy/default.nix

@@ -116,8 +116,6 @@ in
 
 pkgs.dockerTools.buildLayeredImage {
   name = "blumeops/alloy";
-  tag = "latest";
-
   contents = [
     alloy
     pkgs.cacert

containers/authentik-redis/default.nix

@@ -15,8 +15,6 @@ assert pkgs.redis.version == version;
 
 pkgs.dockerTools.buildLayeredImage {
   name = "blumeops/authentik-redis";
-  tag = "latest";
-
   contents = [
     pkgs.redis
   ];

containers/authentik/default.nix

@@ -41,8 +41,6 @@ in
 
 pkgs.dockerTools.buildLayeredImage {
   name = "blumeops/authentik";
-  tag = "latest";
-
   contents = [
     ak
     authentik-django

containers/ntfy/default.nix

@@ -67,8 +67,6 @@ in
 
 pkgs.dockerTools.buildLayeredImage {
   name = "blumeops/ntfy";
-  tag = "latest";
-
   contents = [
     ntfy
     pkgs.cacert