0.32.0: StackPilot self-update (check on page load + one-click update)

- backend/version.py is now the single version source (main.py, agent).
- GET /api/system/update: reads the version tags of the backend's own image
  repo (anonymous v2 token flow, https→http fallback for insecure
  registries), compares the highest semver tag against APP_VERSION; reports
  update_supported from the container's compose labels. 10 min cache.
- POST /api/system/update (admin, audited): spawns a detached helper
  container from the current backend image that runs docker compose pull &&
  up -d on StackPilot's own compose project (project name, working dir and
  config files resolved from its own container labels) — the helper
  outlives the backend being recreated. Non-compose installs get a 400.
- /api/health now returns the version so the UI can detect the switchover.
- TopNav version badge: queries the update status on page load; when a
  newer release exists an amber pill shows the version — one click (admin)
  confirms, triggers the update and overlays a wait screen that polls
  /api/health and reloads once the new version answers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -75,6 +75,14 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 
 ### Phase 4 — Operations
 
+- **Self-update (0.32.0)**: the top-bar version badge checks the registry for a
+  newer StackPilot release on page load (`GET /api/system/update`, anonymous v2
+  token flow, 10 min cache) and shows an amber update pill. One click
+  (`POST /api/system/update`, admin) spawns a detached helper container that runs
+  `docker compose pull && up -d` on StackPilot's own compose project (resolved
+  from its container labels) — the helper survives the backend being recreated;
+  the UI polls `/api/health` and reloads when the new version answers. Installs
+  not managed by compose get a clear "update manually" error instead.
 - **Backup & restore**: per-stack `.tar.gz` backups including named-volume contents
   (snapshotted via a throwaway helper container); restore via upload with optional
   rename, volume restore, and overwrite/conflict detection.
@@ -422,6 +430,7 @@ POST   /api/stacks/{id}/{start|stop|restart|pull|update|down|clone}
 GET    /api/stacks/{id}/logs                     GET /api/stacks/{id}/export
 POST   /api/stacks/convert                       (docker run → compose)
 GET    /api/system/info | gpus | devices         GET /api/audit
+GET    /api/system/update                         POST /api/system/update (self-update)
 WS     /ws/logs/{stack_id}[/{service}]           WS  /ws/events
 ```