New update endpoints for fleet management — start a software update, check progress, read build/git info, and ask whether an update is available, all over the token API (POST /api/server/update, GET update_status / build_info / update_check; see API docs)
Starting an update now has real server-side guards — it refuses while sessions are recording (unless explicitly forced) and while an update is already running; the Tools page Update button gets the same protection
Control Centre
Update a single server or selected servers straight from Control Centre — select boxes on the Servers page (or use the Update button on a server's page), confirm, and watch live per-server progress as each box goes offline, updates, and comes back on the new build
Servers that are behind show an "update available" badge with the waiting build number (checked automatically every 15 minutes)
New alerts — server updated (info) and server update failed (critical, including boxes that don't come back within 45 minutes)
Control Centre deploys separately; restart its scheduler service after pulling this build. Fleet boxes need one ordinary update (to this build) before remote updates can reach them
