fix(scheduler): harden auto-update policies with cascade deletes, error reporting, and UI fixes (#545)

* fix(scheduler): harden auto-update policies with cascade deletes, error reporting, and UI fixes

- Fix orphaned task runs on policy/node deletion with transaction-wrapped cascade deletes
- Make manual trigger non-blocking (202 Accepted) to prevent proxy timeouts
- Distinguish registry check failures from clean "no update" results via structured ImageCheckResult
- Trim whitespace-only policy names in both frontend and backend validation
- Add strokeWidth={1.5} to action icons per design system
- Add sr-only DialogDescription for Radix accessibility
- Replace Select with Combobox for frequency picker
- Wrap run history sheet content in ScrollArea
- Support concurrent Run Now indicators via Set-based state
- Abort stale stack fetches on node switch with AbortController
- Add standard and diagnostic logging to SchedulerService and ImageUpdateService
- Add tests for cascade deletes, image checking, and scheduler edge cases
- Add troubleshooting section to auto-update docs

* fix(tests): resolve lint errors in image-update-service tests

Remove unused mock variables (mockGetImage, mockGetDocker) and unused
ImageCheckResult type import. Replace CommonJS require('yaml') with
ESM import to satisfy no-require-imports rule.

* chore(deps): bump Docker CLI to 29.4.0 and Compose to v5.1.2

Resolves Trivy CVE-2026-32282 (Go stdlib symlink follow in Root.Chmod)
by upgrading to releases that ship Go 1.25.9. Compose v5.1.2 also bumps
grpc to 1.80.0, resolving CVE-2026-33186.

* chore(security): accept CVE-2026-32282 in .trivyignore, update stale refs

Go stdlib symlink-following in Root.Chmod (CVE-2026-32282) affects both
Docker CLI 29.4.0 (Go 1.26.1) and Compose v5.1.2 (Go 1.25.8). Fix
requires Go 1.25.9 or 1.26.2; no upstream static binary ships a patched
runtime yet. The vulnerable code path requires a chroot context with
attacker-controlled filesystem, which does not apply to our usage.

Also updates version references from v5.1.1/v29.3.1 to v5.1.2/v29.4.0
for existing CVE entries, and notes that Compose v5.1.2 resolved
CVE-2026-33186 (grpc bumped to 1.80.0) for the compose binary.

backend/src/services/DatabaseService.ts

@@ -990,9 +990,10 @@ export class DatabaseService {
             throw new Error('Cannot delete the default node');
         }
         this.db.transaction(() => {
-            this.db.prepare('DELETE FROM nodes WHERE id = ?').run(id);
+            this.db.prepare('DELETE FROM scheduled_task_runs WHERE task_id IN (SELECT id FROM scheduled_tasks WHERE node_id = ?)').run(id);
             this.db.prepare('DELETE FROM scheduled_tasks WHERE node_id = ?').run(id);
             this.db.prepare('DELETE FROM stack_update_status WHERE node_id = ?').run(id);
+            this.db.prepare('DELETE FROM nodes WHERE id = ?').run(id);
         })();
     }
 
@@ -1481,7 +1482,10 @@ export class DatabaseService {
     }
 
     public deleteScheduledTask(id: number): void {
-        this.db.prepare('DELETE FROM scheduled_tasks WHERE id = ?').run(id);
+        this.db.transaction(() => {
+            this.db.prepare('DELETE FROM scheduled_task_runs WHERE task_id = ?').run(id);
+            this.db.prepare('DELETE FROM scheduled_tasks WHERE id = ?').run(id);
+        })();
     }
 
     public getDueScheduledTasks(now: number): ScheduledTask[] {