tower 0.59.2 — bring-your-own only: drop platform-Vault rung from CF resolver

Per docs/decisions/0001-platform-fallback-deferred.md, instance DNS
automation no longer silently falls back to v3/platform/cloudflare-token.
Tenants without a configured CF token get a clear error at instance
create instead of pretending to work via shared infrastructure.
The platform Vault entry stays seeded for future revival.

values.yaml

@@ -8,8 +8,7 @@ backend:
     # the docker-mirror-pull deploy token (read-only registry scope),
     # so every cluster that runs Tower needs the same imagePullSecret
     # provisioned out-of-band (until cluster-platform-v3 owns it).
-    repository: registry.odoosky.cloud/odoosky/docker-mirror/tower
-    tag: "0.59.1"
+    tag: "0.59.2"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull