api | web | docs: add a check for updates button to the account menu - #20

Closes UNB-417.

A new release could take up to 15 minutes to show up in Settings. The release list is cached in Redis for 10 minutes, and the raw GitHub CDN adds about 5 more. To apply releases right after tagging, unbind-updater:updates was deleted from the platform Redis by hand nine times between 2026-10-12 and 2026-10-14.

• Web: system admins now see a "Check for updates" row above the version in the account menu, in both the dropdown and the mobile drawer. It shows a spinner while checking, then "Up to date", "Update available" or "Check failed". "Up to date" and "Check failed" go back to idle after 3 seconds. "Update available" stays until the menu closes, and clicking it opens the updates page.
• API: a new POST /system/update/check endpoint (system admin only) skips the Redis cache, fetches the release list again and stores the result. If the list was refreshed less than 10 seconds ago, it returns the cached list so repeated clicks don't use up the unauthenticated GitHub API quota. If GitHub can't be reached, it returns a 502 and leaves the existing cache alone.
• Release metadata is now read from the default branch through the GitHub contents API instead of the raw CDN. A release shows up as soon as its metadata is pushed.
• Docs: the updating guide now mentions the button.

Testing

• Updater tests cover these cases: a refresh skips a fresh cache and replaces it, a second refresh within the 10 seconds returns the cache, and a failed refresh keeps the old cache.
• Release metadata tests now use a mocked contents API. They cover a fetch error, a path that is a directory instead of a file, and invalid JSON.