Implement robust auto-update system for GuruConnect agent

Features:
- Agent checks for updates periodically (hourly) during idle
- Admin can trigger immediate updates via dashboard "Update Agent" button
- Silent updates with in-place binary replacement (no reboot required)
- SHA-256 checksum verification before installation
- Semantic version comparison

Server changes:
- New releases table for tracking available versions
- GET /api/version endpoint for agent polling (unauthenticated)
- POST /api/machines/:id/update endpoint for admin push updates
- Release management API (/api/releases CRUD)
- Track agent_version in machine status

Agent changes:
- New update.rs module with download/verify/install/restart logic
- Handle ADMIN_UPDATE WebSocket command for push updates
- --post-update flag for cleanup after successful update
- Periodic update check in idle loop (persistent agents only)
- agent_version included in AgentStatus messages

Dashboard changes:
- Version display in machine detail panel
- "Update Agent" button for each connected machine

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

server/src/main.rs

@@ -223,6 +223,15 @@ async fn main() -> Result<()> {
         .route("/api/machines/:agent_id", get(get_machine))
         .route("/api/machines/:agent_id", delete(delete_machine))
         .route("/api/machines/:agent_id/history", get(get_machine_history))
+        .route("/api/machines/:agent_id/update", post(trigger_machine_update))
+
+        // REST API - Releases and Version
+        .route("/api/version", get(api::releases::get_version))  // No auth - for agent polling
+        .route("/api/releases", get(api::releases::list_releases))
+        .route("/api/releases", post(api::releases::create_release))
+        .route("/api/releases/:version", get(api::releases::get_release))
+        .route("/api/releases/:version", put(api::releases::update_release))
+        .route("/api/releases/:version", delete(api::releases::delete_release))
 
         // HTML page routes (clean URLs)
         .route("/login", get(serve_login))
@@ -472,6 +481,62 @@ async fn delete_machine(
     }))
 }
 
+// Update trigger request
+#[derive(Deserialize)]
+struct TriggerUpdateRequest {
+    /// Target version (optional, defaults to latest stable)
+    version: Option<String>,
+}
+
+/// Trigger update on a specific machine
+async fn trigger_machine_update(
+    _user: AuthenticatedUser,  // Require authentication
+    State(state): State<AppState>,
+    Path(agent_id): Path<String>,
+    Json(request): Json<TriggerUpdateRequest>,
+) -> Result<impl IntoResponse, (StatusCode, &'static str)> {
+    let db = state.db.as_ref()
+        .ok_or((StatusCode::SERVICE_UNAVAILABLE, "Database not available"))?;
+
+    // Get the target release (either specified or latest stable)
+    let release = if let Some(version) = request.version {
+        db::releases::get_release_by_version(db.pool(), &version).await
+            .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "Database error"))?
+            .ok_or((StatusCode::NOT_FOUND, "Release version not found"))?
+    } else {
+        db::releases::get_latest_stable_release(db.pool()).await
+            .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "Database error"))?
+            .ok_or((StatusCode::NOT_FOUND, "No stable release available"))?
+    };
+
+    // Find session for this agent
+    let session = state.sessions.get_session_by_agent(&agent_id).await
+        .ok_or((StatusCode::NOT_FOUND, "Agent not found or offline"))?;
+
+    if !session.is_online {
+        return Err((StatusCode::BAD_REQUEST, "Agent is offline"));
+    }
+
+    // Send update command via WebSocket
+    // For now, we send admin command - later we'll include UpdateInfo in the message
+    let sent = state.sessions.send_admin_command(
+        session.id,
+        proto::AdminCommandType::AdminUpdate,
+        &format!("Update to version {}", release.version),
+    ).await;
+
+    if sent {
+        info!("Sent update command to agent {} (version {})", agent_id, release.version);
+
+        // Update machine update status in database
+        let _ = db::releases::update_machine_update_status(db.pool(), &agent_id, "downloading").await;
+
+        Ok((StatusCode::OK, "Update command sent"))
+    } else {
+        Err((StatusCode::INTERNAL_SERVER_ERROR, "Failed to send update command"))
+    }
+}
+
 // Static page handlers
 async fn serve_login() -> impl IntoResponse {
     match tokio::fs::read_to_string("static/login.html").await {