v0.1.16: JWT auth via nubes API, auto-provisioning, UI login

- app/auth/jwt.go: ParseJWTClaims, TenantIDFromSub (sless-compatible SHA256), PingNubesAPI
- app/admin/admin.go: POST /ui/api/auth endpoint, jwtMiddleware for /ui/api/*
- app/tenant/tenant_store.go: NubesSub/Email fields, GetBySub, CreateFromJWT
- app/ui/index.html: login page, email in navbar, JWT session in localStorage
- deployments/k8s/deployment.yaml: v0.1.16, NUBES_ENDPOINT env
- doc/decisions/resource-limits-plan.md: 20 vulnerabilities audit
- Fix: /ui/api/auth moved to subrouter (gorilla/mux PathPrefix conflict)

deployments/k8s/deployment.yaml

@@ -1,6 +1,6 @@
 # deployments/k8s/deployment.yaml
 # Deployment shared-sqs — strategy RollingUpdate (теперь возможен т.к. Redis хранит состояние)
-# Updated: 2026-04-10 — добавлена Redis persistence, Recreate → RollingUpdate
+# Updated: 2026-04-10 — v0.1.16: JWT auth через nubes API, fix route ordering
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -25,7 +25,7 @@ spec:
     spec:
       containers:
       - name: shared-sqs
-        image: naeel/shared-sqs:v0.1.14
+        image: naeel/shared-sqs:v0.1.16
         ports:
         - containerPort: 4100
           name: http
@@ -52,6 +52,8 @@ spec:
             secretKeyRef:
               name: shared-sqs-redis
               key: password
+        - name: NUBES_ENDPOINT
+          value: "https://deck-api-test.ngcloud.ru/api/v1"
         resources:
           requests:
             memory: "64Mi"