tower 0.58.0 — Phase D: landing + signup + tenantless onboarding

- public POST /api/auth/signup + magic-link verify activates pending users
- POST /api/me/tenants — tenantless self-tenant creation
- /me.tenantless flag drives /welcome routing
- resolveEffectiveTenant picks user's primary tenant when JWT drifts
- new LandingView, SignupView, WelcomeView (lazy-loaded)
- LoginView simplified to magic-link only

values.yaml

@@ -9,7 +9,7 @@ backend:
     # so every cluster that runs Tower needs the same imagePullSecret
     # provisioned out-of-band (until cluster-platform-v3 owns it).
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower
-    tag: "0.57.10"
+    tag: "0.58.0"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull
@@ -29,7 +29,7 @@ frontend:
   enabled: true
   image:
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower-ui
-    tag: "0.57.11"
+    tag: "0.58.0"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull