feat(updates): check Gitea automatically and deploy on owner confirmation

Add owner-only update controls, a read-only SSH checker and independent systemd deployment services. Build before maintenance; back up code and database; restore on failed deployment. Preserve runtime configuration and gate business writes during the switch.

frontend/src/router/routePermissions.ts

@@ -47,6 +47,7 @@ export const ROUTE_PERMISSIONS: Record<string, readonly string[]> = {
   '/faq': ['manage_knowledge'],
   '/tickets': TICKET_PERMISSIONS,
   '/tickets/:id': TICKET_PERMISSIONS,
+  '/settings/system-updates': ['super_admin'],
   '/settings/ticketing': ['manage_organization'],
   '/conversations': CHAT_VIEW_PERMISSIONS,
   '/people': PEOPLE_PERMISSIONS,