feat(updates): auto-apply and self-restart on new dashboard versions

Adds POST /api/updates/apply (pull, rebuild, restart) plus an "Update now"
button and hourly auto-check in the UI, for checkouts that are safely
fast-forwardable. Reintroduces self-restart (previously removed in edc25ca
for cross-environment reliability concerns) per explicit user request.

server/__tests__/updates.test.js

@@ -90,12 +90,17 @@ describe("POST /api/updates/check", () => {
   });
 });
 
-describe("removed POST /api/updates/apply", () => {
-  it("returns 404 because self-update has been removed", async () => {
+describe("POST /api/updates/apply", () => {
+  it("declines with a reason instead of pulling/restarting when there is nothing to apply", async () => {
+    // The test repo checkout has no update pending (or isn't fast-forwardable
+    // from a bare test run), so this exercises the decline path only — it must
+    // never touch the working tree or process in a test run.
     const res = await httpFetch("/api/updates/apply", {
       method: "POST",
       body: "{}",
     });
-    assert.equal(res.status, 404);
+    assert.equal(res.status, 409);
+    assert.equal(res.body.applied, false);
+    assert.ok(["up_to_date", "not_fast_forwardable"].includes(res.body.reason));
   });
 });