fix(auto-update): address review feedback

- Health check: a failed restart command no longer lets the check run
  against the still-running old process; it counts as a failure (and after a
  rollback, as a failed rollback). An unreadable restart count is never
  treated as stable, since a crash loop looks healthy between attempts.
- Installer writes the auto_update setting to a temp file and swaps it in,
  keeping mode and owner, so a running config watcher never reads a
  truncated config.json.
- Verify unit quotes its command-line paths (install folders with spaces);
  setup refuses folder names systemd would reinterpret (%, quotes,
  backslashes, control characters) and says so on the General tab.
- The auto-update status route no longer returns exception text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

systemd/ledmatrix-update-verify.service

@@ -13,6 +13,7 @@
 # interface creates data/auto_update_verify.request. It runs as the web
 # interface's own user, and ExecStart points at the copy the updater makes
 # before pulling, so the update being checked cannot replace its checker.
+# Command-line paths are quoted so an install folder with spaces still works.
 
 [Unit]
 Description=LED Matrix automatic update health check and rollback
@@ -22,8 +23,8 @@ Type=oneshot
 User=__USER__
 WorkingDirectory=__PROJECT_ROOT_DIR__
 # Consume the request first, so the path unit cannot start this again.
-ExecStartPre=/bin/rm -f __PROJECT_ROOT_DIR__/data/auto_update_verify.request
-ExecStart=/usr/bin/python3 __PROJECT_ROOT_DIR__/data/auto_update_verifier.py __PROJECT_ROOT_DIR__
+ExecStartPre=/bin/rm -f "__PROJECT_ROOT_DIR__/data/auto_update_verify.request"
+ExecStart=/usr/bin/python3 "__PROJECT_ROOT_DIR__/data/auto_update_verifier.py" "__PROJECT_ROOT_DIR__"
 TimeoutStartSec=30min
 StandardOutput=syslog
 StandardError=syslog