tower 0.61.16 / tower-ui 0.61.16 — review fixes

Two bugs the calm re-review surfaced:

1. substrateGateRejection used ListApplications (instance-only
   selector) — same bug we fixed in handleListServers but missed in
   the gate function. Result: the BACKEND gate was a pass-through
   for every preparing server. Frontend disable held the line in
   normal use, but the non-bypassable layer wasn't actually
   non-bypassable. Now uses ListClusterPlatformApps.

2. PlatformAppBadge had its own Argo→state mapping that classified
   Health=Degraded as 'Failed' immediately. Backend's
   deriveSubstrateStatus is forgiving within the budget (Degraded
   inside 10-min window reads as preparing). The two parallel
   logics meant the badge could show red 'Failed' while the gate
   considered it 'preparing'. Refactored badge to consume the
   backend's substrateStatus enum directly — single source of
   truth, no more disagreement.

values.yaml

@@ -9,7 +9,7 @@ backend:
     # so every cluster that runs Tower needs the same imagePullSecret
     # provisioned out-of-band (until cluster-platform-v3 owns it).
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower
-    tag: "0.61.15"
+    tag: "0.61.16"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull
@@ -29,7 +29,7 @@ frontend:
   enabled: true
   image:
     repository: registry.odoosky.cloud/odoosky/docker-mirror/tower-ui
-    tag: "0.61.13"
+    tag: "0.61.16"
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: docker-mirror-pull