fix: use Docker v2 registry API for tag listing

The DO management API has a caching layer that delays tag visibility
after push. The v2 registry API returns tags immediately.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/services/git.ts

@@ -5,13 +5,20 @@ import { join } from "path";
 import { config } from "../lib/config";
 
 export async function getLatestChartVersion(): Promise<string> {
-  // Query backend image tags instead of Helm chart tags — DO API is unreliable for OCI helm artifacts
-  const res = await fetch("https://api.digitalocean.com/v2/registry/lunarfront/repositories/lunarfront-app/tags?page=1&per_page=100", {
-    headers: { Authorization: `Bearer ${config.doToken}` },
+  // Use Docker v2 registry API — the DO management API has a caching layer that delays tag visibility
+  // Step 1: Get a bearer token via the registry auth endpoint
+  const authRes = await fetch(
+    "https://api.digitalocean.com/v2/registry/auth?service=registry.digitalocean.com&scope=repository:lunarfront/lunarfront-app:pull",
+    { headers: { Authorization: `Basic ${btoa(`token:${config.doToken}`)}` } },
+  );
+  const { token: bearerToken } = await authRes.json() as { token: string };
+
+  // Step 2: List tags via v2 API (returns all tags immediately after push)
+  const res = await fetch("https://registry.digitalocean.com/v2/lunarfront/lunarfront-app/tags/list", {
+    headers: { Authorization: `Bearer ${bearerToken}` },
   });
-  const data = await res.json() as { tags: { tag: string }[] };
+  const data = await res.json() as { tags: string[] };
   const versions = (data.tags ?? [])
-    .map(t => t.tag)
     .filter(t => /^\d+\.\d+\.\d+$/.test(t))
     .sort((a, b) => {
       const [aMaj, aMin, aPat] = a.split(".").map(Number);