chore(release): hoocloak 2.1.0

[wakemeup0]

Complete the prepared Hoocloak 2.1.0 release after the release workflow failed on the protected main branch.

The failed run attempted to rewrite main and create v2.2.0, which repository rules rejected. This change tags the already reviewed release commit after its main CI succeeds, verifies the tag points to that commit, and feeds the existing image, chart, and GitHub Release jobs. It also accepts GitHub's squash-merge PR suffix for a release commit and for a manual publication retry.

• Compatibility: no change to Hoocloak runtime behavior beyond feat(hoocloak): allow default password for users without hash #16.
• Security: the default hoo password remains limited to users without a configured hash, as documented in feat(hoocloak): allow default password for users without hash #16. Tag creation still requires successful CI on the exact release commit.
• Deployment: merge with the PR title shown here so the existing release workflow recognizes the release commit.
• Rollback: no runtime rollback is needed for this CI-only change; the v2.1.0 tag is checked for commit identity and never moved.

Validation: Bash subject matching was checked for exact, PR-suffixed, and incorrect versions; git diff --check passed. The full GitHub CI remains the release gate.