feat(config): add [velocity] login_image/lobby_image for system servers

setup provisions the always-on login/lobby system services only when these image refs are set; empty means skip-and-say-so (the same fail-loud stance manifests takes), since no official LOOHP/Limbo image exists and a deployment must build its own.

internal/config/config.go

@@ -37,6 +37,16 @@ type DatabaseConfig struct {
 type VelocityConfig struct {
 	PublicIP        string `toml:"public_ip"`
 	ServiceTokenRef string `toml:"service_token_ref"`
+	// LoginImage is the container image for the always-on "login" limbo (the
+	// LOOHP/Limbo auth gate). setup provisions the login system service only when
+	// this is set; empty means "don't guess" — setup skips the login server and
+	// says so, the same fail-loud stance manifests takes for images it cannot
+	// safely default. No official LOOHP/Limbo image exists, so a deployment builds
+	// one (see deploy/limbo) and points this at the pushed ref.
+	LoginImage string `toml:"login_image"`
+	// LobbyImage is the container image for the always-on "lobby" hub (Paper plus
+	// the felis-paper /menu plugin). Same skip-when-empty contract as LoginImage.
+	LobbyImage string `toml:"lobby_image"`
 }
 
 // AuthConfig is the [auth] table: the two privileged faces and the access-JWT