fix: route Fiesta mob/orders/createorder and web/products/create directly, sync image tag

These two paths were routed through the NATS gateway sidecar (port 8000,
fiesta-gateway-script), whose only NATS consumer (worker-orders/products in
core) has EXTERNAL_BASE_URL hardcoded to jupiter. Fiesta has no NATS
consumer of its own, so every mobile order/product submitted through this
route was silently created on jupiter (header-only, wrong schema) instead
of ever reaching this backend's CreateOrderv3 - no orderdetails, no stock
movement, no error surfaced to the client (fire-and-forget "accepted").

Both paths are already registered directly on this backend, so they now
fall through the catch-all rule straight to it (port 80), synchronously.
Verified live: a real order now moves stock and a no-items order gets an
immediate 400 instead of a silent phantom accept.

Also corrects the image tag (v1.3.78 -> v1.3.90) to match what's actually
running - it had drifted since Flux was removed and cluster changes now
happen via direct kubectl.

manifests/nearle/nearle-fiesta.yaml

@@ -47,7 +47,7 @@ spec:
             app: fiesta
       containers:
       - name: backend
-        image: nearlecommerce/fiesta:v1.3.78
+        image: nearlecommerce/fiesta:v1.3.90
         imagePullPolicy: Always
         securityContext:
           allowPrivilegeEscalation: false
@@ -144,20 +144,17 @@ spec:
   hostnames:
   - "fiesta.nearle.app"
   rules:
-  - matches:
+  # mob/orders/createorder and web/products/create used to be routed to the
-    - path:
+  # NATS gateway sidecar (port 8000, ConfigMap fiesta-gateway-script). That
-        type: PathPrefix
+  # sidecar publishes onto the shared "ORDERS"/"PRODUCTS" NATS subjects,
-        value: /live/api/v1/mob/orders/createorder
+  # whose only consumer (worker-orders/worker-products in the core namespace)
-    backendRefs:
+  # has EXTERNAL_BASE_URL hardcoded to jupiter, not this backend. Fiesta has
-    - name: fiesta
+  # no NATS consumer of its own, so every order/product submitted through
-      port: 8000
+  # that path was silently created on jupiter (header-only, wrong schema)
-  - matches:
+  # instead of ever reaching CreateOrderv3 here. Both paths are already
-    - path:
+  # registered directly on this backend (routes/orderroutes.go,
-        type: PathPrefix
+  # routes/productroutes.go), so route them straight through synchronously
-        value: /live/api/v1/web/products/create
+  # via the catch-all rule below instead of overriding them to the sidecar.
-    backendRefs:
-    - name: fiesta
-      port: 8000
   - matches:
     - path:
         type: PathPrefix