#795: Updates aus der WebUI ueber den Instanzmanager

Das Update-Angebot gab es nur im Desktop-Fenster. Der Manager prueft jetzt
selbst und spielt ein: erst alle Instanzen geordnet anhalten, dann
- ohne systemd: update-agent mit --wait-for-pid und --restart,
- unter systemd: clawddotnet-update.service anstossen (Vorlage unter
  deploy/systemd), damit der agent keinen zweiten Manager neben dem
  Dienst startet (DC SETUP_INTEGRATION_GUIDE 4A).
Fehlt die Unit, wird nichts angehalten; scheitert die Uebergabe, kommen
die Instanzen wieder hoch. Anleitung in InstanceSetupGuide Abschnitt 8.

Nebenbei: Sprachpaket wird vor dem Kopf geladen (rohe Schluessel im Kopf).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/clawddotnet-manager.service

@@ -0,0 +1,31 @@
+# ClawdDotNet instance manager as a systemd user service (#795).
+#
+# Install (as the user that runs ClawdDotNet):
+#   cp clawddotnet-manager.service ~/.config/systemd/user/
+#   # adjust the paths below to your installation directory
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now clawddotnet-manager.service
+#   loginctl enable-linger "$USER"   # keeps it running without a login session
+#
+# KillMode=process: stopping the service stops the manager, not the instances it started.
+# The manager stops them itself when that is wanted (before an update, for example);
+# a restart of the manager alone takes them over again.
+
+[Unit]
+Description=ClawdDotNet instance manager
+After=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=%h/clawddotnet
+ExecStart=%h/clawddotnet/ClawdDotNet.Instanzmanager
+Restart=on-failure
+RestartSec=15
+KillMode=process
+# The console output carries the web access token on an interactive console only;
+# the journal never gets it, but there is nothing else in it worth keeping.
+StandardOutput=null
+StandardError=journal
+
+[Install]
+WantedBy=default.target

deploy/systemd/clawddotnet-update.service

@@ -0,0 +1,30 @@
+# Installs an update for ClawdDotNet, started from the web interface (#795).
+#
+# Why a unit of its own (Deploymentcenter SETUP_INTEGRATION_GUIDE §4A): started from the
+# manager, the update agent would restart the manager itself - a second manager next to
+# the service. Here systemd stops the service, the agent updates, and systemd starts the
+# service again. The manager only stops its instances and triggers this unit:
+#   systemctl --user start --no-block clawddotnet-update.service
+#
+# Install next to clawddotnet-manager.service:
+#   cp clawddotnet-update.service ~/.config/systemd/user/
+#   # adjust paths and channel below
+#   install -m 600 /dev/null ~/.config/clawddotnet/update.env
+#   echo 'DC_LICENSE_KEY=<your license key>' >> ~/.config/clawddotnet/update.env
+#   systemctl --user daemon-reload
+#
+# The license key goes through the environment file (0600), never the command line:
+# "ps" shows command lines to every user of the machine.
+
+[Unit]
+Description=ClawdDotNet update (stop manager, update, start manager)
+
+[Service]
+Type=oneshot
+EnvironmentFile=%h/.config/clawddotnet/update.env
+TimeoutStartSec=20min
+ExecStartPre=/usr/bin/systemctl --user stop clawddotnet-manager.service
+ExecStart=%h/clawddotnet/update-agent --action update --project clawddotnet --base-url https://dc.mhdf.de --channel prod --version latest --target-dir %h/clawddotnet --require-signature
+# ExecStopPost and not ExecStartPost: it also runs when the update failed. A failed update
+# must not leave the manager down.
+ExecStopPost=/usr/bin/systemctl --user start clawddotnet-manager.service