fix(auto-update): label same-tag rebuilds as 'Rebuild available' instead of '10.11 -> 10.11' (#766)

When a registry pushes a new build of an image at the same tag (digest
changes, tag does not), the preview service set next_tag to the same
string as current_tag and the readiness view rendered '10.11 -> 10.11',
which reads as a UI bug.

Add an update_kind field to UpdatePreviewSummary that distinguishes:
- 'tag'    - at least one image has a strictly newer tag
- 'digest' - the only updates available are same-tag rebuilds
- 'none'   - nothing to apply

The frontend now branches on update_kind and renders 'Rebuild available'
next to the current tag for the digest case, leaving the version-arrow
diff for genuine tag bumps.

Three new buildSummary cases lock in the kind classification.

backend/src/__tests__/update-preview-service.test.ts

@@ -224,4 +224,23 @@ describe('buildSummary', () => {
         expect(preview.summary.semver_bump).toBe('major');
         expect(preview.summary.blocked).toBe(true);
     });
+
+    it('reports update_kind="tag" when at least one image has a strictly newer tag', () => {
+        const images = [
+            baseImage({ service: 'web', has_update: true, semver_bump: 'patch', next_tag: '1.0.1', current_tag: '1.0.0' }),
+        ];
+        expect(buildSummary('stacky', images).summary.update_kind).toBe('tag');
+    });
+
+    it('reports update_kind="digest" when only same-tag rebuilds are available', () => {
+        const images = [
+            baseImage({ service: 'web', has_update: true, semver_bump: 'patch', next_tag: '10.11', current_tag: '10.11', image: 'redis:10.11' }),
+        ];
+        expect(buildSummary('stacky', images).summary.update_kind).toBe('digest');
+    });
+
+    it('reports update_kind="none" when nothing has an update', () => {
+        const images = [baseImage({ service: 'clean', has_update: false })];
+        expect(buildSummary('stacky', images).summary.update_kind).toBe('none');
+    });
 });