feat: stage managed updates before restart

[caigee-cmd]

Summary

• Split managed updates into image preparation and operator-confirmed restart.
• Keep normal API traffic available while the host updater pulls the target image.
• Persist ready_to_apply so a page refresh or application restart does not lose the confirmation step.
• Only pause new traffic after confirmation, then create the SQLite backup, recreate the container, health-check, and roll back on failure.
• Add staged updater protocol support while keeping the legacy /v1/update endpoint.
• Update the System page, bilingual copy, design notes, changelog, and embedded static assets.

Validation

• go test ./...
• cd frontend && npm run sync
• cd frontend && npm run lint (passes with existing warnings)
• git diff --check