feat(configure): auto-restart the always-on service after a self-upgrade

[hyoshi]

Non-engineer operators run mureo as an always-on service and don't know how to restart it, so the post-upgrade "restart mureo configure" prompt left them stuck on the old version. This auto-restarts the daemon after a successful one-click upgrade — but only when it runs under an auto-start supervisor. A plain interactive mureo configure (terminal user) keeps the manual prompt, as requested.

How

• Supervised detection: mureo service install stamps MUREO_MANAGED_SERVICE=1 into the launchd plist (EnvironmentVariables) and the systemd unit (Environment=). Not on Windows — Task Scheduler doesn't relaunch a task that exits cleanly, so that path stays manual (verified by a test). mureo.web.service.is_managed_service() reads the marker.
• Restart: _post_upgrade adds restarting to the /api/upgrade envelope and, when managed, schedules a graceful wizard.request_stop() then an os._exit(0) backstop after the response flushes. launchd KeepAlive / systemd Restart=always (already configured) relaunch the daemon on the new code. is_managed_service is imported lazily to avoid a handlers→service→server→handlers cycle.
• Frontend: on restarting, dashboard.js shows "Restarting…", polls GET /api/ping, and location.reload()s once the daemon has clearly restarted — the reported version changed OR a down→up transition was seen (robust for plugin-only upgrades where the mureo version is unchanged). 60s manual fallback.

The version check and "Update all" continue to cover mureo plus every installed mureo-* plugin (agency, bridges).

Test plan

• 244 web/service tests pass. New: plist/unit env marker, is_managed_service env mapping (strict == "1"), Windows has no marker, restarting flag (managed True+restart scheduled / unmanaged False+not), and the _restart_runner os._exit path (incl. exit even when request_stop raises) — exercised with time.sleep/os._exit patched so the suite never exits.
• ruff + black + mypy clean; node --check on dashboard.js; i18n.json valid.
• code-reviewer: no CRITICAL/HIGH after fixes (timing-only reload → version/down-up discriminator; tested the exit path; gate + Windows-exclusion tests).
• Live browser (fetch override, no real restart): one-click "Update all" with restarting:true → "Restarting…" → version change detected → auto-reload to a fresh page; no console errors.
• Note: existing always-on installs must re-run mureo service install once to gain the marker (idempotent).