feat(updates): auto-apply and self-restart on new dashboard versions

Adds POST /api/updates/apply (pull, rebuild, restart) plus an "Update now"
button and hourly auto-check in the UI, for checkouts that are safely
fast-forwardable. Reintroduces self-restart (previously removed in edc25ca
for cross-environment reliability concerns) per explicit user request.

openapi.yaml

@@ -6328,6 +6328,35 @@ paths:
                 error:
                   code: UPDATE_CHECK_FAILED
                   message: 'git fetch failed: network unreachable'
+  /api/updates/apply:
+    post:
+      tags:
+        - Updates
+      summary: Pull, rebuild, and restart the dashboard when fast-forwardable
+      operationId: applyUpdate
+      responses:
+        '200':
+          description: Checkout fast-forwarded and rebuilt; the process is about to self-restart
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+                description: 'Same shape as GET /api/updates/status, plus applied: true.'
+        '409':
+          description: Declined - nothing to apply, or the checkout isn't safely fast-forwardable
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+                description: 'applied: false plus reason: "up_to_date" | "not_fast_forwardable".'
+        '500':
+          description: Update apply failed
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
   /api/alerts:
     get:
       tags: