feat(updates): check Gitea automatically and deploy on owner confirmation

Add owner-only update controls, a read-only SSH checker and independent systemd deployment services. Build before maintenance; back up code and database; restore on failed deployment. Preserve runtime configuration and gate business writes during the switch.

deploy/server/systemd/replypier-update-check.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Check ReplyPier Gitea main for updates (never installs)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/python3 /opt/replypier-updater/cli.py check
+ExecStopPost=/usr/bin/python3 /opt/replypier-updater/cli.py finish-check
+TimeoutStartSec=180
+UMask=0077