fix(tenant-service): 放开 /api/system/versions/manifest 无需鉴权

私有部署通过此端点从云端拉取最新版本清单（VERSIONS_MANIFEST_URL），
不能要求登录态，否则私有服务器无法获取更新信息。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tenant-service/src/main/java/com/xuqm/tenant/config/SecurityConfig.java

@@ -41,6 +41,7 @@ public class SecurityConfig {
                     "/api/migrate/export",          // key-based auth, no JWT
                     "/api/private/deployment/migrate/import",  // private deployment only, no JWT
                     "/api/private/admin/**",         // private deployment internal maintenance, no JWT
+                    "/api/system/versions/manifest", // 公开：私有部署拉取云端最新版本清单，无需鉴权
                     "/actuator/health",
                     "/actuator/info"
                 ).permitAll()