feat(web): weekly automatic updates with health check and rollback

A General-tab toggle (off by default) checks for and installs LEDMatrix and
plugin updates once a week, overnight in the configured timezone.

- Pre-update checks skip (and report) instead of forcing: local edits or
  commits, merge/live rebase, no upstream, low disk, missing health check, or
  a version that was already rolled back. An abandoned rebase (HEAD back on a
  branch) is cleared, since it would otherwise block every pull.
- The pull reuses the Update Code path (now perform_core_update(), which
  reports dependency install failures as data).
- ledmatrix-update-verify.service, started via a .path unit from a request
  file, restarts the services from its own cgroup, requires them to come up
  and stay up, and otherwise resets to the previous commit and reinstalls the
  previous requirements. It runs a copy of the checker taken before the pull.
- No SSH needed: switching the toggle on restarts the display service, which
  (as root) installs the two units from the repo templates for the web user.
  first_time_install.sh installs them too and takes --enable-auto-update /
  LEDMATRIX_AUTO_UPDATE (passed through by one-shot-install.sh).
- Plugins update after the code passes its check; failures, blocks and
  rollbacks raise an Overview banner and show under the toggle.

Tested end to end on a Pi: web-UI setup, a good update, a broken web service
and a broken display (both rolled back), a blocked local edit, and an
abandoned rebase found on the device.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web_interface/app.py

@@ -1052,8 +1052,36 @@ def check_health_monitor():
             _reconciliation_started = True
             _threading.Thread(target=_run_startup_reconciliation, daemon=True).start()
 
+_auto_updater = None
+
+
+def start_auto_update_scheduler():
+    """Start the weekly auto-update thread (web_interface/auto_update.py).
+
+    Called by the launchers, not at import: tests and dev tools import this
+    module, and none of them should ever git pull. Idle unless
+    auto_update.enabled is set, so it is safe to always start.
+    """
+    global _auto_updater
+    if _auto_updater is not None:
+        return _auto_updater
+    from web_interface.auto_update import AutoUpdater
+    from web_interface.blueprints.api_v3.system import perform_core_update
+    _auto_updater = AutoUpdater(
+        config_manager=config_manager,
+        core_update=perform_core_update,
+        store_manager=plugin_store_manager,
+        plugin_manager=plugin_manager,
+        schema_manager=schema_manager,
+        operation_history=operation_history,
+    )
+    _auto_updater.start()
+    return _auto_updater
+
+
 if __name__ == '__main__':
     import os as _os
+    start_auto_update_scheduler()
     # threaded=True is Flask's default since 1.0 but stated explicitly so that
     # long-lived /api/v3/stream/* SSE connections don't starve other requests.
     # Debug mode is off by default; opt in with FLASK_DEBUG=1 in the environment.