Extract update/version routes and helpers from app.py

[raychrisgdp]

Goal

Move local dashboard update/version endpoints and helper functions out of app.py into a dedicated module.

Candidate Scope

• /api/app-version
• /api/update
• Git command helpers used only by update/version behavior
• Localhost/header guard helpers if they are update-specific

Constraints

• Preserve current safety checks for local-only update actions.
• Keep dirty-worktree and fast-forward behavior unchanged.
• Avoid mixing this with dashboard data route refactors.

Verification

• Existing update/version tests continue to pass.
• scripts/review.sh passes from a worktree.