ui: fleet update page + endpoints

- POST /api/fleet/update, POST /api/fleet-updates/{id}/cancel,
  GET /api/fleet-updates/{id} (admin-only).
- GET /settings/fleet-update + /partial for htmx polling.
- Renders idle / running / terminal states with per-host progress.
- Tests cover happy path, derive-host-ids, conflict, cancel, get,
  and RBAC.

web/templates/pages/fleet_update.html

@@ -0,0 +1,32 @@
+{{define "title"}}Fleet update · restic-manager{{end}}
+
+{{define "content"}}
+{{$page := .Page}}
+<div class="max-w-[1280px] mx-auto px-8 pb-14">
+
+  {{/* breadcrumbs */}}
+  <div class="crumbs pt-6">
+    <a href="/">Dashboard</a><span class="sep">/</span>
+    <a href="/settings">Settings</a><span class="sep">/</span>
+    <span class="text-ink-mid">fleet update</span>
+  </div>
+
+  {{/* page header */}}
+  <div class="flex items-baseline justify-between mt-3.5">
+    <div>
+      <h1 class="text-[22px] font-medium tracking-[-0.005em]">
+        Fleet update
+        <span class="text-ink-fade font-normal text-[14px] ml-2 mono">target {{$page.TargetVersion}}</span>
+      </h1>
+      <p class="text-ink-mute text-[12px] mt-1 max-w-[760px] leading-[1.55]">
+        Rolling, sequential agent self-update. One host at a time, halts on first failure,
+        cancellable mid-roll. Only online hosts whose <span class="mono">agent_version</span>
+        differs from the server are eligible.
+      </p>
+    </div>
+  </div>
+
+  {{template "fleet_update_inner" .}}
+
+</div>
+{{end}}