v1.10.1 — fix Patch security button

Fixed

• "Patch security" button applied all pending updates instead of security-only ones — it was wired to the exact same handler as "Patch all", with no security-only path anywhere in frontend or backend.

Changed

• Single-host patching now supports a security-only mode:
  • APT: filters to packages already flagged is_security, upgrades only those via apt-get install --only-upgrade
  • DNF: uses native dnf upgrade --security, cross-checked against dnf updateinfo list security
  • Nobara: warns and skips rather than silently running a full nobara-sync (no security filter exists there)