ui: fleet update page + endpoints

- POST /api/fleet/update, POST /api/fleet-updates/{id}/cancel,
  GET /api/fleet-updates/{id} (admin-only).
- GET /settings/fleet-update + /partial for htmx polling.
- Renders idle / running / terminal states with per-host progress.
- Tests cover happy path, derive-host-ids, conflict, cancel, get,
  and RBAC.

internal/server/ui/ui.go

@@ -108,6 +108,8 @@ func New() (*Renderer, error) {
 		"templates/partials/tree_node.html",
 		"templates/partials/alert_row.html",
 		"templates/partials/crit_banner.html",
+		"templates/partials/fleet_update_inner.html",
+		"templates/partials/host_update_chip.html",
 	}
 
 	pageEntries, err := fs.Glob(web.FS, "templates/pages/*.html")