Console: return [] for an empty group list, and fix its deployment manifest

GET /api/clients returned "groups": null when there were no groups, because the
merged list was a nil slice. Found against the real cluster.

The console manifest, never applied before, had an image name that does not
exist here, no image pull secret or architecture selector (the resolver's pods
have both), and pointed at a Service (fancy-dns-admin) that is not there. It
now uses the registry image, the pull secret, and the existing fancy-dns-web
Service.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/k8s/console/console.yaml

@@ -72,19 +72,24 @@ spec:
       labels: {app.kubernetes.io/name: fancy-dns-console}
     spec:
       serviceAccountName: fancy-dns-console
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      imagePullSecrets:
+        - name: reg-k6n
       securityContext:
         runAsNonRoot: true
         runAsUser: 65532
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: console
-          image: fancydns/fancy-dns:latest
+          image: registry.k6n.net/fancydns
+          imagePullPolicy: Always
           command: ["/usr/local/bin/fancy-dns-console"]
           args:
             - -config=/etc/fancy-dns/console.yaml
             # A Service in front of the resolver pods. With several replicas, the
             # per-pod views (status, cache, upstreams) come from whichever pod answers.
-            - -runtime-url=http://fancy-dns-admin.dns.svc:8080
+            - -runtime-url=http://fancy-dns-web.dns.svc:8080
           env:
             - name: FANCYDNS_RUNTIME_KEY
               valueFrom: {secretKeyRef: {name: fancy-dns-console-runtime, key: FANCYDNS_RUNTIME_KEY}}