fix(update): self-upgrade via sudo systemd-run + animiertes Modal

handler: edgeguard-User darf systemd-run nicht direkt aufrufen ("Inter-
active authentication required"). sudo -n + sudoers-Whitelist auf
exakt die Unit-Form für edgeguard-upgrade.service.

UI: UpdateBanner-Komponente neu — Pattern wie mail-gateway/enconf:
Banner mit Force-Check-Button + Popconfirm. Beim Apply zeigt full-
screen-Overlay mit animiertem Orbit (zwei Ringe + Dots), Versions-
sprung, vier Step-Indicators (Download/Install/Restart/Verify) und
Live-Timer. Poll auf /system/health detektiert Version-Flip ODER
"sah down dann up" und window.reload nach 1.5s. Sicherheits-Timeout
2 min schickt sonst auch reload.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -306,17 +306,23 @@
     "setupCompleted": "Setup completed"
   },
   "update": {
-    "available": "Update available: {{pkg}} {{installed}} → {{available}}",
-    "viewDetails": "View details",
-    "applyNow": "Apply now",
-    "applying": "Update in progress …",
-    "applyingHint": "Packages are installed and services restarted. Connection may briefly break — the UI reloads automatically once version {{version}} is live.",
-    "applyingDetail": "current {{current}} · target {{target}}",
-    "started": "Update has started — the server will restart shortly.",
+    "available": "Update available: version {{version}}",
+    "multiPackageHint": "{{count}} packages will be updated.",
+    "applyNow": "Install now",
+    "confirmTitle": "Install update now?",
+    "confirmDesc": "Packages will be updated to version {{version}}. edgeguard-api + scheduler restart (~2-5 s), HAProxy/nft/WG/Squid/Unbound/Chrony stay running.",
+    "checkNow": "Check for updates",
+    "checkDone": "Update available",
+    "noUpdate": "No new updates",
+    "checkFailed": "Update check failed",
+    "running": "Update in progress …",
+    "waitHint": "Please wait — the page will reload automatically once the new version is live.",
     "success": "Updated to {{version}}.",
-    "modalTitle": "EdgeGuard update",
-    "modalIntro": "The following packages will be updated:",
-    "modalWarn": "During the update edgeguard-api + edgeguard-scheduler restart (~2-5 s service interruption). HAProxy + nft + WireGuard + Squid + Unbound + Chrony stay up the whole time."
+    "failed": "Update failed",
+    "stepDownload": "Download packages",
+    "stepInstall": "Install",
+    "stepRestart": "Service restart",
+    "stepVerify": "Verification"
   },
   "wg": {
     "title": "WireGuard",