feat(auto-update): per-stack auto-update enable/disable toggle (#771)

* feat(auto-update): add per-stack auto-update enable/disable toggle

Paid users (Skipper and Admiral) can now opt individual stacks out of
scheduled auto-updates from the stack context menu without disabling
the global feature.

- Add stack_auto_update_settings table (node_id, stack_name) with
  default enabled=true; four typed DatabaseService accessors with
  parameterized queries.
- Add GET /stacks/auto-update-settings, GET /stacks/:name/auto-update,
  and PUT /stacks/:name/auto-update (requirePaid + requireAdmin).
  PUT broadcasts state-invalidate with action auto-update-settings-changed
  so all open tabs refresh immediately.
- Stack DELETE clears the auto-update setting row alongside stack_update_status.
- autoUpdateRouter /execute skips disabled stacks before any registry
  call; skip is recorded in the results array. Manual Update actions
  are not affected.
- Add Auto-update: Enabled/Disabled toggle in the stack inspect group
  (paid tiers only, hidden for Community, consistent with Auto-Heal).
  Toggle uses optimistic update with revert-on-error toast.
- AutoUpdateReadinessView shows an Auto: Off pill and disables the
  Apply now button for stacks with auto-updates off. Detection still
  runs so the readiness card remains visible.
- Add 21 backend Vitest tests covering DB round-trips, endpoint auth
  and tier gates, execute skip for both wildcard and named targets.
  Add 3 frontend hook tests for toggle visibility and callback behavior.

* docs(auto-update): document per-stack auto-update control

Add a Per-stack control section to the auto-update readiness page
explaining how to disable and re-enable auto-updates for individual
stacks, what disabling means (scheduled apply skipped; detection still
runs; manual update unaffected), and a troubleshooting entry for
scheduled runs not applying to a specific stack.

frontend/src/hooks/__tests__/useStackMenuItems.test.tsx

@@ -10,11 +10,13 @@ function makeCtx(overrides: Partial<StackMenuCtx> = {}): StackMenuCtx {
     hasPort: true,
     isBusy: false,
     isPaid: true,
+    isAdmiral: false,
     canDelete: true,
     isPinned: false,
     labels: [],
     assignedLabelIds: [],
     menuVisibility: { showDeploy: false, showStop: true, showRestart: true, showUpdate: false },
+    autoUpdateEnabled: true,
     openAlertSheet: vi.fn(),
     openAutoHeal: vi.fn(),
     checkUpdates: vi.fn(),
@@ -29,6 +31,7 @@ function makeCtx(overrides: Partial<StackMenuCtx> = {}): StackMenuCtx {
     toggleLabel: vi.fn(),
     createAndAssignLabel: vi.fn(),
     openLabelManager: vi.fn(),
+    setAutoUpdateEnabled: vi.fn(),
     ...overrides,
   };
 }
@@ -88,6 +91,28 @@ describe('useStackMenuItems', () => {
     expect(ids).toEqual(['deploy', 'update']);
   });
 
+  it('shows auto-update toggle in inspect when isPaid', () => {
+    const { result } = renderHook(() => useStackMenuItems('web.yml', makeCtx({ isPaid: true, autoUpdateEnabled: true })));
+    const inspect = result.current.find(g => g.id === 'inspect')!;
+    expect(inspect.items.find(i => i.id === 'auto-update')).toBeDefined();
+  });
+
+  it('hides auto-update toggle when !isPaid', () => {
+    const { result } = renderHook(() => useStackMenuItems('web.yml', makeCtx({ isPaid: false })));
+    const inspect = result.current.find(g => g.id === 'inspect')!;
+    expect(inspect.items.find(i => i.id === 'auto-update')).toBeUndefined();
+  });
+
+  it('auto-update toggle calls setAutoUpdateEnabled with toggled value', () => {
+    const setAutoUpdateEnabled = vi.fn();
+    const { result } = renderHook(() =>
+      useStackMenuItems('web.yml', makeCtx({ isPaid: true, autoUpdateEnabled: true, setAutoUpdateEnabled }))
+    );
+    const inspect = result.current.find(g => g.id === 'inspect')!;
+    inspect.items.find(i => i.id === 'auto-update')!.onSelect();
+    expect(setAutoUpdateEnabled).toHaveBeenCalledWith(false);
+  });
+
   it('disables every lifecycle item when isBusy', () => {
     const { result } = renderHook(() => useStackMenuItems('web.yml', makeCtx({
       isBusy: true,

frontend/src/hooks/useStackMenuItems.tsx

@@ -3,6 +3,7 @@ import {
   Activity,
   ArrowUpRight,
   BellRing,
+  CircleSlash,
   Download,
   Pin,
   PinOff,
@@ -20,7 +21,7 @@ export function useStackMenuItems(_file: string, ctx: StackMenuCtx): MenuGroup[]
     stackStatus, hasPort, isBusy, isPaid, canDelete, isPinned, labels,
     openAlertSheet, openAutoHeal, checkUpdates, openStackApp,
     deploy, stop, restart, update, remove, pin, unpin, toggleLabel,
-    menuVisibility,
+    menuVisibility, autoUpdateEnabled, setAutoUpdateEnabled,
   } = ctx;
   const { showDeploy, showStop, showRestart, showUpdate } = menuVisibility;
 
@@ -32,6 +33,12 @@ export function useStackMenuItems(_file: string, ctx: StackMenuCtx): MenuGroup[]
     ];
     if (isPaid) {
       inspect.push({ id: 'auto-heal', label: 'Auto-Heal', icon: Activity, shortcut: 'H', onSelect: openAutoHeal });
+      inspect.push({
+        id: 'auto-update',
+        label: autoUpdateEnabled ? 'Auto-update: Enabled' : 'Auto-update: Disabled',
+        icon: autoUpdateEnabled ? RefreshCw : CircleSlash,
+        onSelect: () => setAutoUpdateEnabled(!autoUpdateEnabled),
+      });
     }
     inspect.push({ id: 'check-updates', label: 'Check updates', icon: RefreshCw, shortcut: 'U', onSelect: checkUpdates });
     if (stackStatus === 'running' && hasPort) {
@@ -80,6 +87,7 @@ export function useStackMenuItems(_file: string, ctx: StackMenuCtx): MenuGroup[]
   }, [
     stackStatus, hasPort, isBusy, isPaid, canDelete, isPinned, labels,
     showDeploy, showStop, showRestart, showUpdate,
+    autoUpdateEnabled, setAutoUpdateEnabled,
     openAlertSheet, openAutoHeal, checkUpdates, openStackApp,
     deploy, stop, restart, update, remove, pin, unpin, toggleLabel,
   ]);