fix(auto-update): address review feedback

- Health check: a failed restart command no longer lets the check run
  against the still-running old process; it counts as a failure (and after a
  rollback, as a failed rollback). An unreadable restart count is never
  treated as stable, since a crash loop looks healthy between attempts.
- Installer writes the auto_update setting to a temp file and swaps it in,
  keeping mode and owner, so a running config watcher never reads a
  truncated config.json.
- Verify unit quotes its command-line paths (install folders with spaces);
  setup refuses folder names systemd would reinterpret (%, quotes,
  backslashes, control characters) and says so on the General tab.
- The auto-update status route no longer returns exception text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web_interface/blueprints/api_v3/system.py

@@ -129,10 +129,11 @@ def get_auto_update_status():
     try:
         config = api_v3.config_manager.load_config() if api_v3.config_manager else {}
         return jsonify({'status': 'success', 'data': auto_update.describe_status(config)})
-    except Exception as e:
+    except Exception:
+        # Details stay in the log: exception text can carry file paths.
         logger.error("get_auto_update_status failed", exc_info=True)
-        return jsonify({'status': 'error', 'message': 'Could not read automatic update status',
-                        'details': describe_exception(e)}), 500
+        return jsonify({'status': 'error',
+                        'message': 'Could not read automatic update status; see logs for details'}), 500
 
 
 @api_v3.route('/system/auto-update/dismiss', methods=['POST'])