v0.9.0 — One-click self-update (homegrown, no OTM)

Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an
admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook +
docker socket) over the internal network with a shared secret; the sidecar runs
'git fetch && reset --hard origin/master && docker compose up -d --build app'
detached. The UI polls /api/version until the rebuilt app returns on the new
version, then reloads.

Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of
the repo (host .env only). No request data reaches the shell — the command is
fixed in updater/update.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile.updater

@@ -0,0 +1,7 @@
+# Privileged self-update sidecar. Holds the docker socket and, on an
+# authenticated webhook trigger, runs `git pull && docker compose up -d --build app`
+# against the moonbase stack. It only ever runs the fixed updater/update.sh —
+# no request data reaches the shell. See docker-compose.yml + updater/hooks.json.
+FROM docker:27-cli
+RUN apk add --no-cache git docker-cli-compose webhook
+ENTRYPOINT ["webhook"]