Add local app update control

[raychrisgdp]

Summary

• Add a local-only App Update control to the dashboard summary area.
• Add /api/app-version to check the current checkout against latest origin/main and report whether an update is available.
• Add localhost-only POST /api/update that refuses unsafe states, fast-forwards from origin main, runs uv sync, and reports restart-needed status.
• Cover current, update-available, dirty-worktree, diverged, git failure, uv failure, and non-local request cases.

UX Notes

The dashboard shows one visible update control. It auto-detects whether latest main requires an update:

• Up to Date when current with origin/main
• Update App when a fast-forward update is available
• Blocked when an update exists but local changes would be overwritten
• Manual Update when the checkout cannot fast-forward cleanly

Validation

• uv run python -m unittest tests.test_app tests.test_readme -v
• uv run python -m py_compile app.py scripts/snapshot_dashboard.py
• scripts/review.sh
• Browser smoke check at http://localhost:8344/
• Direct API checks for /api/app-version and POST /api/update

Closes #34