feat(updates): check Gitea automatically and deploy on owner confirmation

Add owner-only update controls, a read-only SSH checker and independent systemd deployment services. Build before maintenance; back up code and database; restore on failed deployment. Preserve runtime configuration and gate business writes during the switch.

backend/app/main.py

@@ -22,6 +22,7 @@ os.environ.setdefault('TOKENIZERS_PARALLELISM', 'false')
 from fastapi.staticfiles import StaticFiles
 import socketio
 from app.api import chat, organizations, users, ai_setup, knowledge, agent, notification, widget, widget_apps, user_groups, roles, analytics, jira, shopify, workflow, workflow_node, mcp_tool, file_upload, token, lead_capture, people, tickets
+from app.api import system_updates
 from app.api import help_center as help_center_api
 from app.api import help_center_images
 from app.api import channels as channels_api
@@ -113,6 +114,7 @@ async def startup_event(api: FastAPI):
     api.state.auto_closer_task = asyncio.create_task(run_auto_closer_loop())
 
 # Include routers
+app.include_router(system_updates.router, prefix=f"{settings.API_V1_STR}/system-updates", tags=["system-updates"])
 app.include_router(
     chat.router,
     prefix=f"{settings.API_V1_STR}/chats",
@@ -385,4 +387,6 @@ install_crawler_policy(app)
 from app.api.help_center_public import public_app
 from app.core.help_center_host import HelpCenterHostMiddleware
 
-app = socketio.ASGIApp(sio, HelpCenterHostMiddleware(app, public_app))
+from app.core.system_maintenance import SystemMaintenanceMiddleware
+
+app = SystemMaintenanceMiddleware(socketio.ASGIApp(sio, HelpCenterHostMiddleware(app, public_app)))