Desktop-managed local server that updates with the app

[erwin-wee]

Summary

Fixes the "GitGood 0.2.0 is connected to a GitGood server running 0.1.5" situation: a local server now updates with the desktop app, and the mismatch warning offers a way to fix it.

• File → Run GitGood server in the background… (Linux, installed app only): installs a systemd user service that runs the server bundled in the app (ELECTRON_RUN_AS_NODE). If the server's data folder is empty, it first copies this desktop's settings and repositories there, then switches the desktop to client mode. Asks before replacing an existing service from a source checkout.
• Keeps itself up to date: on every client-mode launch the desktop points that service at its own executable and restarts it when the service changed or the versions differ. The repoint is needed because AppImage updates rename the file. Units from npm run install:service are never touched.
• Desktop updates in client mode: the desktop had no updater at all when connected to a server; it now runs its own and answers app.update.* natively, so updating the desktop also updates a managed server.
• Mismatch dialog has an action button: Restart server (managed), Copy command (checkout), Reload (remote server), or Check for updates (desktop is older).

Notes

• The service command ends in -- --no-sandbox: the AppImage launcher adds --no-sandbox on systems without unprivileged user namespaces, which Electron's Node mode rejects; with it already present after --, the launcher adds nothing and Node ignores it.
• Restarting the server after an update interrupts anything running on it at that moment (e.g. an AI job started from a phone).
• In client mode the update channel comes from the desktop's local settings, not the server's.

Testing

• npm run typecheck clean; npm test 1119 passed, 4 skipped; npm run test:smoke 35/35
• New unit tests for the generated unit (Node-mode command, --no-sandbox handling, quoting of paths with spaces and %)
• Manual, with real AppImages: systemd ran the server from an AppImage (/version 0.2.0); launching a different AppImage in client mode rewrote the unit to point at itself and restarted the service, and the desktop's own update check ran

Not verified: the menu setup flow (dialogs, settings copy, relaunch) and the mismatch-dialog buttons were not driven interactively.