Phase 22: auto-update (Watchtower-style), local + agent (0.28.0)

Per-stack auto-update policy on the stack Overview tab. When the background
image-update check finds a newer registry digest for one of a stack's images,
the stack is pulled + redeployed (or just flagged, "notify only"). Only running
stacks are auto-redeployed; a stopped stack is skipped, never silently started.

- models/auto_update.py: AutoUpdate(stack_id, agent_id, enabled, redeploy,
  last_run/status/result) + schemas; registered in models/__init__.py.
- update_service: DB-free stack_images/stack_updates helpers (agent reuses
  them); agent GET /agent/stacks/{id}/updates.
- services/auto_update_service.py: run_due/run_policy (local pull+up via
  compose_service, remote via agent_service POST /agent/stacks/{id}/update,
  notify-only with per-transition dedup); lazy-called from
  update_service.background_loop. New stack_auto_updated notify event.
- routers: GET/PUT/run /api/stacks/{id}/auto-update and the
  /api/agents/{id}/stacks/{sid}/auto-update variants (policy stored centrally).
- frontend: api/autoUpdate.ts + AutoUpdatePanel (enable, redeploy|notify-only,
  Check now, last-run status) on StackDetail + RemoteStackDetail; EVENT_LABELS
  gains stack_auto_updated + backup_failed.

Live-verified all four paths (updated / update-available / up-to-date /
skipped) against real compose.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -153,6 +153,20 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
   container or connect any container on the host (`POST /api/networks/{id}/connect`
   / `/disconnect`).
 
+### Phase 22 — Auto-update (Watchtower-style)
+
+- A per-stack **Auto-update** policy (on the stack Overview tab): when the
+  background image-update check finds a newer registry digest for one of the
+  stack's images, the stack is either **pulled + redeployed** or merely
+  **flagged** ("notify only"), with a **Check now** button for an on-demand run.
+- Runs inside the existing image-update-check cycle (reuses the freshly-computed
+  digest cache, no extra registry calls). Only **running** stacks are
+  auto-redeployed — a stopped stack is never silently started ("skipped").
+- New `stack_auto_updated` notification event. Works for **remote stacks** too
+  (policy stored centrally; the agent answers `/agent/stacks/{id}/updates` and
+  performs the redeploy). Last run + status (updated / up-to-date /
+  update-available / skipped / error) are shown inline.
+
 ### Phase 21 — Container terminal (web exec)
 
 - An **interactive terminal** into any running, compose-managed container,