Application update

Purpose: Let an operator move the running application to the latest origin/main without SSH, and never leave the checkout half-updated. Scenario: The maintainer, on a phone, opens Tools → Deploy. The page shows the current commit and, from the last fetch, that it is two commits behind. They tap Deploy now; the server fetches, sees a clean main that origin/main fast-forwards, moves HEAD, logs the attempt and shows the new commit. The server's own edit to public/.htaccess survives: the deploy stashes it, fast-forwards and reapplies it. Had the update changed the same lines, the deploy would have gone back to the previous commit with the edit intact and named the file to merge over SSH. The queued Deploy button does the same through the task queue, and ./v3 deploy does it over SSH; all three share one lock and one attempt log. Sources: routine (source unavailable), page and actions (source unavailable), template (source unavailable), page script (source unavailable), CLI (source unavailable), operator guide, tests (source unavailable), page tests (source unavailable).

Boundaries: pull only (no docs publish or static build); only session-authenticated root-approved operators and same-origin requests; opening the page reads local Git state and never fetches.