feat: add node update alerts with changelog tab and skip-version handling (#1463)

* feat: add node update alerts with changelog tab and skip-version handling

- Add node_update_available notification category with blue/brand bell dot
- Route node_update_available notifications to Fleet -> Node updates sheet
- Add Changelog tab to NodeUpdatesSheet with GitHub release notes
- Add per-node skip-version persistence (node_update_skips table)
- Skip hides update CTA on node card and sheet; re-surfaces on newer version
- Skipped nodes excluded from Update all backend filter
- Add pulsating dot indicator on Changelog tab when updates available
- Always-visible View changelog action in notification row bottom
- Admin-only for all mutating controls (skip, unskip, update)
- Backend tests for skip-version semantics (15 tests)
- Update fleet-view.mdx, remote-updates.mdx, and OpenAPI spec

* fix: address audit findings - nested button, stale changelog, semver normalization, mobile intent

- Move View changelog button outside routable button (sibling element)
- Fix aria-label for node_update_available notification rows
- Support ?recheck=true on release-notes endpoint
- Invalidate release notes cache on forced recheck
- Store normalized semver (semver.valid strips v prefix)
- Skip fleetUpdatesIntent on mobile (desktop only)
- Add v-prefix normalization test

* fix: restore View changelog on same line as timestamp, opposite sides

The button is always visible at the bottom right of the notification card,
on the same row as the timestamp (just now), using justify-between layout.

* fix: update tests for node_update_available category and release-notes fetch

- Backend: monitor-service tests now expect node_update_available instead of system
- Frontend: NodeUpdatesSheet tests mock release-notes API call to prevent undefined then()

* fix: resolve ci lint failures

backend/src/services/DatabaseService.ts

@@ -848,6 +848,7 @@ export class DatabaseService {
         this.migrateFleetSyncStickyError();
         this.migrateStackDossierHashes();
         this.migrateGitSourceMultiFile();
+        this.migrateNodeUpdateSkips();
 
         // Reset the cache once at end of constructor in case any migration
         // populated it via getGlobalSettings() and a subsequent migration
@@ -1781,6 +1782,22 @@ export class DatabaseService {
         }
     }
 
+    private migrateNodeUpdateSkips(): void {
+        try {
+            this.db.prepare(`
+                CREATE TABLE IF NOT EXISTS node_update_skips (
+                    node_id INTEGER PRIMARY KEY,
+                    skipped_version TEXT NOT NULL,
+                    skipped_at INTEGER NOT NULL,
+                    skipped_by TEXT NOT NULL,
+                    FOREIGN KEY (node_id) REFERENCES nodes(id) ON DELETE CASCADE
+                )
+            `).run();
+        } catch (e) {
+            console.warn('[DatabaseService] node_update_skips migration:', (e as Error).message);
+        }
+    }
+
     private migrateScanPolicyFleetColumns(): void {
         this.tryAddColumn('scan_policies', 'node_identity', "TEXT NOT NULL DEFAULT ''");
         this.tryAddColumn('scan_policies', 'replicated_from_control', 'INTEGER NOT NULL DEFAULT 0');
@@ -2079,6 +2096,30 @@ export class DatabaseService {
         return !!row?.mesh_enabled;
     }
 
+    // --- Node update skips ---
+
+    public getNodeUpdateSkip(nodeId: number): { skippedVersion: string; skippedAt: number; skippedBy: string } | null {
+        const row = this.db.prepare(
+            'SELECT skipped_version, skipped_at, skipped_by FROM node_update_skips WHERE node_id = ?'
+        ).get(nodeId) as { skipped_version: string; skipped_at: number; skipped_by: string } | undefined;
+        if (!row) return null;
+        return {
+            skippedVersion: row.skipped_version,
+            skippedAt: row.skipped_at,
+            skippedBy: row.skipped_by,
+        };
+    }
+
+    public setNodeUpdateSkip(nodeId: number, version: string, username: string): void {
+        this.db.prepare(
+            'INSERT OR REPLACE INTO node_update_skips (node_id, skipped_version, skipped_at, skipped_by) VALUES (?, ?, ?, ?)'
+        ).run(nodeId, version, Date.now(), username);
+    }
+
+    public deleteNodeUpdateSkip(nodeId: number): void {
+        this.db.prepare('DELETE FROM node_update_skips WHERE node_id = ?').run(nodeId);
+    }
+
     // --- Agents ---
 
     public getAgents(nodeId: number): Agent[] {
@@ -3043,6 +3084,7 @@ export class DatabaseService {
             this.db.prepare('UPDATE blueprints SET pinned_node_id = NULL WHERE pinned_node_id = ?').run(id);
             this.deleteRoleAssignmentsByResource('node', String(id));
             this.db.prepare('DELETE FROM fleet_sync_status WHERE node_id = ?').run(id);
+            this.db.prepare('DELETE FROM node_update_skips WHERE node_id = ?').run(id);
             this.db.prepare('DELETE FROM nodes WHERE id = ?').run(id);
         })();
     }

backend/src/services/MonitorService.ts

@@ -510,7 +510,7 @@ export class MonitorService {
 
         try {
             const notifier = NotificationService.getInstance();
-            await notifier.dispatchAlert('info', 'system',
+            await notifier.dispatchAlert('info', 'node_update_available',
                 `Sencho ${latest} is available (currently running ${currentVersion}). Visit the Fleet dashboard to update.`);
             db.setSystemState(stateKey, latest);
             if (isDebugEnabled()) console.debug(`[Monitor:diag] Dispatched version notification: ${currentVersion} -> ${latest}`);

backend/src/services/NotificationService.ts

@@ -32,6 +32,7 @@ export type NotificationCategory =
     | 'update_started'
     | 'health_gate_passed'
     | 'health_gate_failed'
+    | 'node_update_available'
     | 'system';
 
 export const ALL_NOTIFICATION_CATEGORIES: readonly NotificationCategory[] = [
@@ -40,7 +41,7 @@ export const ALL_NOTIFICATION_CATEGORIES: readonly NotificationCategory[] = [
     'autoheal_triggered', 'monitor_alert', 'scan_finding',
     'blueprint_deployed', 'blueprint_deployment_failed',
     'blueprint_drift_detected', 'blueprint_drift_correction_failed',
-    'system',
+    'node_update_available', 'system',
 ];
 
 /** Webhook timeout: 10 seconds per external dispatch call. */