feat: version update check — notify when newer version is on GitHub (v0.11.8 Beta)

Backend: GET /api/system/version-check fetches frontend/package.json from
the main branch on GitHub, caches result in app_settings for 24 hours,
and compares semver against the running version. Fails silently (no banner)
for air-gapped or firewalled deployments.

Frontend: dismissible blue update banner in SecurityBanners (rendered
between TopBar and main content) — only visible when a newer version is
detected. Shows target version and docker compose update command.

frontend/src/services/api.ts

@@ -343,6 +343,12 @@ export const deviceToolsApi = {
     ),
 };
 
+// ─── System ───────────────────────────────────────────────────────────────────
+export const systemApi = {
+  versionCheck: () =>
+    api.get<{ current: string; latest: string | null; update_available: boolean }>('/system/version-check'),
+};
+
 // ─── Events ───────────────────────────────────────────────────────────────────
 export const eventsApi = {
   list: (params?: {