feat(configure): surface available mureo/plugin updates + one-click mureo upgrade --all (#239)

[hyoshi]

Summary

Closes #239. When mureo configure is running, the dashboard now detects available updates for mureo and any installed mureo-* plugin and offers a one-click upgrade.

• Background check on launch — the dashboard fetches GET /api/updates in the background (non-blocking); the menu renders immediately with no indicator.
• Red menu indicator — once the check returns ≥1 outdated package, the "About mureo" nav item gets a red badge.
• About tab — lists outdated packages as name: installed → latest (in red) and an Update button.
• Confirm-then-run — an in-page confirm panel (not a browser dialog) lists the packages; on confirm it POSTs /api/upgrade, shows progress, and on completion prompts the operator to restart mureo configure (the running server is still on the old code).

Design

• Update check via pip, not direct PyPI calls — check_for_updates() runs python -m pip list --outdated --format=json on sys.executable and filters to mureo/mureo-* (reusing _is_mureo_package / _canonicalise from mureo/cli/upgrade_cmd.py). This respects the operator's configured package index, so private bridges are checked correctly, and it shares the exact venv/index resolution that the upgrade uses — "update available" and "the upgrade" are consistent by construction. No hand-rolled PEP 440, no extra deps. 60s timeout; any failure degrades to status=error, any_update=false and never raises.
• Upgrade targets are server-derived — run_upgrade_all() derives the list from _discover_all_mureo_packages(); _post_upgrade ignores the request body entirely (pinned by a test that smuggles {"packages":[...]} and asserts it never reaches pip). Command is a fixed argv [sys.executable, "-m", "pip", "install", "--upgrade", "--", *targets] (shell=False, -- sentinel). mureo is belt-and-braces prepended when discovery hides it (editable installs), matching the CLI.
• Gating — GET /api/updates is Host-gated (read-only, no CSRF on GET, like /api/about); POST /api/upgrade is CSRF + Host gated like every other POST.

JSON shapes

• GET /api/updates: {"status":"ok"|"error","any_update":bool,"packages":[{"name","installed","latest"},...]} (only outdated mureo* packages)
• POST /api/upgrade: {"status":"ok"|"noop"|"error","returncode":int,"packages":[str,...],"output":<pip tail ≤4000 chars>}

Test plan

• tests/test_web_version_check.py — outdated surfaced, non-mureo filtered out, up-to-date, pip nonzero / timeout / FileNotFound / unparseable-JSON all degrade, mureo-itself included
• tests/test_web_upgrade_action.py — server-derived targets, body irrelevant, success/nonzero/timeout/OSError, noop on empty, output cap, mureo force-prepend parity
• tests/test_web_handlers.py — GET /api/updates shape + Host gating; POST /api/upgrade dispatch + CSRF/Host gating + request-body-ignored
• Asset pins in tests/test_web_about.py (button element, JS fetch/POST, i18n en+ja parity)
• 254 tests pass across the web suites; ruff + black clean. All subprocess/network mocked — no real pip, no network.
• CI green on the PR

Notes

• XSS-safe: all package names/versions render via textContent; the raw pip output tail is not injected into the DOM (a fixed translated message is shown).
• No reentrancy guard on concurrent upgrades — acceptable for a single-user localhost server (the button also disables on click); documented for follow-up if ever needed.