v0.9.0 — One-click self-update (homegrown, no OTM)

Add an admin 'Pull & rebuild' button (Settings → Updates). It POSTs an
admin-gated route that signals a privileged 'updater' sidecar (adnanh/webhook +
docker socket) over the internal network with a shared secret; the sidecar runs
'git fetch && reset --hard origin/master && docker compose up -d --build app'
detached. The UI polls /api/version until the rebuilt app returns on the new
version, then reloads.

Secret matching uses webhook -template + getenv so UPDATER_SECRET stays out of
the repo (host .env only). No request data reaches the shell — the command is
fixed in updater/update.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

updater/update.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Triggered by the webhook sidecar when an admin clicks "Pull & rebuild".
+# Runs the rebuild DETACHED so the webhook responds immediately — otherwise the
+# app container (which the admin's browser is talking to) would be recreated
+# mid-request. The app UI then polls /api/version until the new version answers.
+#
+# Only `app` is rebuilt: postgres and this updater are left running untouched.
+set -e
+
+nohup sh -c '
+  cd /appdata
+  echo "=== update $(date) ==="
+  git fetch origin master
+  git reset --hard origin/master
+  COMPOSE_PROJECT_NAME=moonbase docker compose up -d --build app
+  echo "=== done $(date) ==="
+' >> /appdata/update.log 2>&1 &
+
+echo "update started"