feat(updates): check Gitea automatically and deploy on owner confirmation

Add owner-only update controls, a read-only SSH checker and independent systemd deployment services. Build before maintenance; back up code and database; restore on failed deployment. Preserve runtime configuration and gate business writes during the switch.

deploy/server/systemd/replypier-update-check.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Check ReplyPier updates every 30 minutes
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=30min
+Persistent=true
+Unit=replypier-update-check.service
+
+[Install]
+WantedBy=timers.target