Updater: fresh release list on Settings, System, Check for updates, and Update now - #462

Summary

A self-hosted install saw a new release only up to an hour after it was published, because the updater kept GitHub's release list for an hour. Opening Settings, System didn't refresh it, and neither did invoking the updater. Seen live: v0.8.32 was published at 17:22 UTC, the install had last read the list at 16:51, and the page kept offering v0.8.31 (known broken) until the hour ran out.

Changes

• Opening Settings, System (status) reads the list again when the copy is more than 2 minutes old. The hourly background check still keeps its copy for an hour.
• Check for updates: status with refresh reads the list right away. The new gateway route POST /api/system/releases/check sends it. Only team admins who are also install admins can call it (may_check_releases, plus the usual require_role(3)), and it is listed under the system capability.
• Rate limit: each install reads GitHub (or latest.json) at most once every 30 seconds, whoever asks. A failed try counts toward the limit and shows up as releases.error. Every read sends If-None-Match with the stored ETag. A 304 counts as a check, keeps the list and uses no API quota.
• Never offer an older release: the updater reads launch/latest.json as a hint, also with its ETag and the same limits. If the hint names a release the cached list lacks, the list is read again. If the newer release still isn't listed (latest.json, or the newest stable release seen before), nothing older is offered. status returns latest: null with releases.behind, update_now refuses, and the hourly check neither installs nor sends a notice. If a release is still missing after 24 hours, it is treated as withdrawn and the list is used as it is.
• Update now with no version first reads the list again, rate limited, and installs the newest release at that moment. An explicit version still works as before.
• docs/self-host/updates.md: how updates are found.

Verification

• python3 -m unittest discover -s lambda/tests: 312 passed. New tests cover:
  • a stale copy is read again when Settings opens, and reloads within 2 minutes reuse it
  • presses within 30 seconds share one read
  • a failed read counts toward the limit and is reported
  • the ETag is sent and a 304 keeps the list (also at the urllib level, using a stub opener)
  • a newer release named in latest.json triggers a fresh read
  • while a newer release is unlisted, no older one is offered, Update now refuses and the hourly check doesn't apply anything
  • a release missing for a day is treated as withdrawn
  • a newer preview release never holds back the stable channel
  • Update now resolves the newest release with a fresh read
  • the Lambda wires in fetch_latest
• cargo fmt --check, cargo clippy -p gateway --all-targets -- -D warnings, cargo test -p gateway: 695 passed, including only_install_admins_may_check_for_releases and the permissions-table route check.