feat: add node update alerts with changelog tab and skip-version handling (#1463)

* feat: add node update alerts with changelog tab and skip-version handling

- Add node_update_available notification category with blue/brand bell dot
- Route node_update_available notifications to Fleet -> Node updates sheet
- Add Changelog tab to NodeUpdatesSheet with GitHub release notes
- Add per-node skip-version persistence (node_update_skips table)
- Skip hides update CTA on node card and sheet; re-surfaces on newer version
- Skipped nodes excluded from Update all backend filter
- Add pulsating dot indicator on Changelog tab when updates available
- Always-visible View changelog action in notification row bottom
- Admin-only for all mutating controls (skip, unskip, update)
- Backend tests for skip-version semantics (15 tests)
- Update fleet-view.mdx, remote-updates.mdx, and OpenAPI spec

* fix: address audit findings - nested button, stale changelog, semver normalization, mobile intent

- Move View changelog button outside routable button (sibling element)
- Fix aria-label for node_update_available notification rows
- Support ?recheck=true on release-notes endpoint
- Invalidate release notes cache on forced recheck
- Store normalized semver (semver.valid strips v prefix)
- Skip fleetUpdatesIntent on mobile (desktop only)
- Add v-prefix normalization test

* fix: restore View changelog on same line as timestamp, opposite sides

The button is always visible at the bottom right of the notification card,
on the same row as the timestamp (just now), using justify-between layout.

* fix: update tests for node_update_available category and release-notes fetch

- Backend: monitor-service tests now expect node_update_available instead of system
- Frontend: NodeUpdatesSheet tests mock release-notes API call to prevent undefined then()

* fix: resolve ci lint failures

backend/src/routes/fleet.ts

@@ -20,7 +20,7 @@ import { requirePaid, requireAdmin, requireNodeProxy } from '../middleware/tierG
 import { scheduleLocalUpdate } from './license';
 import { runPolicyGate, assertPolicyGateAllows, buildPolicyGateOptions } from '../helpers/policyGate';
 import { captureLocalNodeFiles, captureRemoteNodeFiles, buildSnapshotDocumentation, pickDossierFields, dossierHasContent, type SnapshotNodeData, type SnapshotDocumentation } from '../utils/snapshot-capture';
-import { getLatestVersion } from '../utils/version-check';
+import { getLatestVersion, getLatestRelease } from '../utils/version-check';
 import { isValidStackName } from '../utils/validation';
 import { isDebugEnabled } from '../utils/debug';
 import { getErrorMessage } from '../utils/errors';
@@ -1009,6 +1009,19 @@ fleetRouter.get('/update-status', authMiddleware, async (req: Request, res: Resp
         ) {
           invalidateRemoteMetaCache(node.id);
         }
+
+        // Apply skip-version: suppress updateAvailable when the node has skipped
+        // the effective compare target (which may be the gateway fallback, not
+        // just the raw GitHub latest).
+        const skipRow = db.getNodeUpdateSkip(node.id);
+        let skipActive = false;
+        let skippedVersion: string | null = null;
+        if (skipRow && compareValid && skipRow.skippedVersion === compareVersion) {
+          updateAvailable = false;
+          skipActive = true;
+          skippedVersion = skipRow.skippedVersion;
+        }
+
         return {
           nodeId: node.id,
           name: node.name,
@@ -1018,6 +1031,8 @@ fleetRouter.get('/update-status', authMiddleware, async (req: Request, res: Resp
           updateAvailable,
           updateStatus: currentTracker?.status ?? null,
           error: currentTracker?.error ?? null,
+          skipActive,
+          skippedVersion,
         };
       }),
     );
@@ -1034,6 +1049,8 @@ fleetRouter.get('/update-status', authMiddleware, async (req: Request, res: Resp
         updateAvailable: false,
         updateStatus: null,
         error: null,
+        skipActive: false,
+        skippedVersion: null,
       };
     });
 
@@ -1047,6 +1064,21 @@ fleetRouter.get('/update-status', authMiddleware, async (req: Request, res: Resp
     res.status(500).json({ error: 'Failed to fetch update status' });
   }
 });
+// Release notes for the Changelog tab in the Node Updates sheet.
+fleetRouter.get('/update-status/release-notes', authMiddleware, async (req: Request, res: Response): Promise<void> => {
+  try {
+    const forceRefresh = req.query.recheck === 'true';
+    const release = await getLatestRelease(forceRefresh);
+    res.json({
+      releaseNotes: release?.body ?? null,
+      htmlUrl: release?.html_url ?? null,
+    });
+  } catch (error) {
+    console.error('[Fleet] Release notes error:', error);
+    res.status(500).json({ error: 'Failed to fetch release notes' });
+  }
+});
+
 
 // Pilot loopback targets carry an empty apiToken because the tunnel bridge
 // re-injects admin auth; sending a malformed `Bearer ` header would 401 on
@@ -1061,6 +1093,57 @@ function postSystemUpdate(target: { apiUrl: string; apiToken: string }) {
   });
 }
 
+// --- Skip-version endpoints ---
+
+fleetRouter.post('/nodes/:nodeId/skip-version', authMiddleware, async (req: Request, res: Response): Promise<void> => {
+    if (!requireAdmin(req, res)) return;
+    try {
+      const nodeId = parseIntParam(req, res, 'nodeId');
+      if (nodeId === null) {
+        return;
+      }
+      const db = DatabaseService.getInstance();
+      const node = db.getNode(nodeId);
+      if (!node) {
+        res.status(404).json({ error: 'Node not found' });
+        return;
+      }
+      const { version } = req.body ?? {};
+      const normalized = typeof version === 'string' ? semver.valid(version) : null;
+      if (!normalized || version.length > 64) {
+        res.status(400).json({ error: 'Invalid version' });
+        return;
+      }
+      const username = req.user?.username ?? 'unknown';
+      db.setNodeUpdateSkip(nodeId, normalized, username);
+      res.status(204).end();
+    } catch (error) {
+      console.error('[Fleet] Skip-version error:', error);
+      res.status(500).json({ error: 'Failed to skip version' });
+    }
+  });
+
+fleetRouter.delete('/nodes/:nodeId/skip-version', authMiddleware, async (req: Request, res: Response): Promise<void> => {
+    if (!requireAdmin(req, res)) return;
+    try {
+      const nodeId = parseIntParam(req, res, 'nodeId');
+      if (nodeId === null) {
+        return;
+      }
+      const db = DatabaseService.getInstance();
+      const node = db.getNode(nodeId);
+      if (!node) {
+        res.status(404).json({ error: 'Node not found' });
+        return;
+      }
+      db.deleteNodeUpdateSkip(nodeId);
+      res.status(204).end();
+    } catch (error) {
+      console.error('[Fleet] Unskip-version error:', error);
+      res.status(500).json({ error: 'Failed to unskip version' });
+    }
+  });
+
 fleetRouter.post('/nodes/:nodeId/update', authMiddleware, async (req: Request, res: Response): Promise<void> => {
   if (!requireAdmin(req, res)) return;
   try {
@@ -1166,6 +1249,12 @@ fleetRouter.post('/update-all', authMiddleware, async (req: Request, res: Respon
       if (tracker && (tracker.status === 'timeout' || tracker.status === 'failed' || tracker.status === 'completed')) {
         updateTracker.delete(node.id);
       }
+      // Skip nodes that have skipped the current compare target version.
+      const skipRow = db.getNodeUpdateSkip(node.id);
+      if (skipRow && compareValid && skipRow.skippedVersion === compareVersion) {
+        if (debug) console.debug('[Fleet:debug] Update-all skipping', node.name, '(version', compareVersion, 'skipped)');
+        return false;
+      }
       return true;
     });