controller v0.271.0: automatic app updates — the update leg after the off-site copy, the backup gate waits, the switch (09 6.4 part 7; R-680, R-678, R-643)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/templates/app_info.html

@@ -38,6 +38,8 @@
 <div class="alert alert-warning" style="margin-top:1rem" data-update-error="true">{{updateErrorText .Stack}}</div>
 {{else if .UpdateUndoneLine}}
 <div class="alert alert-info" style="margin-top:1rem" data-update-undone="true">{{.UpdateUndoneLine}}</div>
+{{else if .AutoUpdateLine}}
+<div class="alert alert-info" style="margin-top:1rem" data-auto-update="done">{{.AutoUpdateLine}}</div>
 {{end}}
 
 {{if .MissingStorageLabel}}

controller/internal/web/templates/settings_system.html

@@ -143,6 +143,26 @@
     </div>
 </div>
 
+<!-- Section: Automatic app updates (v0.271.0, `09` §3 decision 12) — the per-box switch, ON by default. -->
+<div class="settings-card" id="app-update">
+    <h3>{{T "settings_system.app_update_title"}}</h3>
+    <p class="settings-card-desc">{{T "settings_system.app_update_desc"}}</p>
+    {{if .AppUpdateSuccess}}<div class="alert alert-info">{{.AppUpdateSuccess}}</div>{{end}}
+    {{if .AppUpdateError}}<div class="alert alert-error">{{.AppUpdateError}}</div>{{end}}
+    <form method="POST" action="/settings/app-update">
+        {{.CSRFField}}
+        <div class="form-group">
+            <label style="display:flex;align-items:center;gap:.5rem">
+                <input type="checkbox" name="app_update_unattended" value="on" {{if .AppUpdateUnattended}}checked{{end}} data-app-update-unattended="{{.AppUpdateUnattended}}">
+                {{T "settings_system.app_update_toggle"}}
+            </label>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="btn btn-primary">{{T "settings_system.app_update_save"}}</button>
+        </div>
+    </form>
+</div>
+
 <!-- Section: Network (R-66) — the box's own address. Every value is live-computed per render and
      stored NOWHERE (S-5: a DHCP lease persisted anywhere eventually misdirects people); a missing
      value renders „—" because an address-less row beats a wrong address. -->