v0.9.0 — One-click self-update (homegrown, no OTM)

Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an
admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook +
docker socket) over the internal network with a shared secret; the sidecar runs
'git fetch && reset --hard origin/master && docker compose up -d --build app'
detached. The UI polls /api/version until the rebuilt app returns on the new
version, then reloads.

Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of
the repo (host .env only). No request data reaches the shell — the command is
fixed in updater/update.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

updater/hooks.json

@@ -0,0 +1,15 @@
+[
+  {
+    "id": "moonbase-update",
+    "execute-command": "/appdata/updater/update.sh",
+    "command-working-directory": "/appdata",
+    "response-message": "update started",
+    "trigger-rule": {
+      "match": {
+        "type": "value",
+        "value": "{{ getenv \"UPDATER_SECRET\" }}",
+        "parameter": { "source": "header", "name": "X-Update-Token" }
+      }
+    }
+  }
+]