Show a new version without an Update button when self-update is off

[Sulaiman-Dauda]

What this changes

WINDLASS_NO_SELF_UPDATE made Apply refuse, but Check never said so. A container install, where the image sets the flag, saw "Update available" and an Update now button that could only ever fail (#32). The same was true of any non-Linux build.

• internal/update/update.go has one supported() check. Apply uses it to refuse, as before, and Check reports it as apply_supported on GET /system/update, so the button and the server cannot disagree.
• The Settings update card shows the new version either way. When apply_supported is false it explains that this install updates by pulling the new image or replacing the binary, and shows no button.
• The sidebar "Update available" notice stays for both. Knowing a release exists is still useful when you update by pulling a tag, which is what the issue asks for.
• POST /system/update is unchanged and still answers 400 not_supported, so the server stays the real check.
• api/openapi.yaml and docs/configuration.md describe the new field and what the flag now does in the UI.

How it was verified

• New internal/update/update_test.go stubs the GitHub release call. The two Check tests failed on main (apply_supported = <nil>) and pass now. A third test confirms Apply still refuses with the flag set and never restarts.
• Built the embedded binary and ran two local instances against the real GitHub release (v0.46). With the flag unset the API returned apply_supported: true and the card showed one Update now button. With WINDLASS_NO_SELF_UPDATE=1 it returned false, the card showed the version and the explanation with no button, and a POST still got 400 not_supported. Checked in headless Chromium by visible text and button count.
• go vet ./..., go test ./..., npm run build (typecheck included) and npm test (23 of 23) pass.

Fixes #32

🤖 Generated with Claude Code