feat(updates): check Gitea automatically and deploy on owner confirmation

Add owner-only update controls, a read-only SSH checker and independent systemd deployment services. Build before maintenance; back up code and database; restore on failed deployment. Preserve runtime configuration and gate business writes during the switch.

backend/tests/core/test_system_maintenance.py

@@ -0,0 +1,27 @@
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+import pytest
+from starlette.websockets import WebSocketDisconnect
+
+from app.core import system_maintenance as maintenance
+
+
+def test_maintenance_gates_business_requests_but_allows_status(tmp_path, monkeypatch):
+    marker = tmp_path / 'maintenance'
+    monkeypatch.setattr(maintenance, 'MAINTENANCE_FILE', marker)
+    app = FastAPI()
+    for path in ['/health', '/api/v1/system-updates', '/api/v1/chats']:
+        app.get(path)(lambda: {'ok': True})
+    client = TestClient(maintenance.SystemMaintenanceMiddleware(app))
+    assert client.get('/api/v1/chats').status_code == 200
+    marker.touch()
+    assert client.get('/health').status_code == 200
+    assert client.get('/api/v1/system-updates').status_code == 200
+    assert client.get('/api/v1/chats').status_code == 503
+    assert client.post('/api/v1/system-updates/check').status_code == 503
+    with pytest.raises(WebSocketDisconnect) as exc:
+        with client.websocket_connect('/socket.io/'):
+            pass
+    assert exc.value.code == 1013