WP-11: package and OS updates from the UI

package_upgrade job streams apt-get output into the job log (streaming
CommandRunner, DebianUpdater with dist-upgrade or --only-upgrade), refreshes
the inventory afterwards and flags reboot-required. POST /api/system/upgrade
(admin), package name validation, selectable package table with confirm
dialog and live log on the Updates page. Fake updater for dev.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/test_support.rs

@@ -84,6 +84,7 @@ async fn build_test_app_with(cfg: Config) -> Router {
         pool,
         Arc::new(RecordingMailer),
         Arc::new(infrastructure::FakeHostInspector),
+        Arc::new(infrastructure::FakeHostUpdater),
         register_test_jobs,
     )
     .expect("state");