WP-11: package and OS updates from the UI

package_upgrade job streams apt-get output into the job log (streaming
CommandRunner, DebianUpdater with dist-upgrade or --only-upgrade), refreshes
the inventory afterwards and flags reboot-required. POST /api/system/upgrade
(admin), package name validation, selectable package table with confirm
dialog and live log on the Updates page. Fake updater for dev.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/openapi.rs

@@ -26,7 +26,7 @@ impl Modify for BearerAuth {
         crate::users::list, crate::users::create, crate::users::get_one, crate::users::update, crate::users::reset_password,
         crate::settings::get_smtp, crate::settings::put_smtp, crate::settings::test_smtp, crate::settings::list_schedules, crate::settings::put_schedule,
         crate::jobs::list, crate::jobs::kinds, crate::jobs::get_one, crate::jobs::run,
-        crate::system::inventory,
+        crate::system::inventory, crate::system::upgrade,
     ),
     modifiers(&BearerAuth)
 )]