feat(admin): ask the panel to restart, from verdande's own settings

A container cannot replace its own image from the inside, so "update" is really
"ask whoever owns the container to recreate it" — Yggdrasil pulls `:latest` on the
way, which is what makes a restart an update at all. This removes the second
browser tab, not the panel's authority: the panel still does the work and still
records who asked.

Three settings, needed together, and the page names whichever are missing — an
operator reading "not configured" should not have to go and find out which of
three. The token is never sent to a browser; the page is told only whether it is
set.

Answers 202 rather than waiting. The panel stops this container as part of
answering, so the reply may never arrive, and a request cut off mid-flight is the
successful case wearing a failure's clothes. The interface believes neither answer
and polls /healthz until it responds.

Administrators only, and sessions only. A leaked API token that could restart the
server is a denial of service in one request.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/src/lib/api.js

@@ -199,6 +199,8 @@ export const api = {
 	deleteUser: (id) => del(`/users/${id}`),
 	revokeInvite: (id) => del(`/invites/${id}`),
 	listErrors: () => get('/errors'),
+	panelStatus: () => get('/panel'),
+	restartFromPanel: () => post('/panel/restart'),
 
 	// The nightly backup, which ran since the beginning with nothing to show it.
 	// The OAuth client itself, which is the instance's registration with Google

web/src/lib/locales/da.js

@@ -635,5 +635,16 @@ export const da = {
 	'passkey.signingIn': 'Venter på enheden…',
 
 	'passkey.unavailable':
-		'Passkeys kan ikke bruges her — enten understøtter browseren dem ikke, eller også er serverens adresse en IP frem for et domænenavn, hvilket ingen authenticator accepterer.'
+		'Passkeys kan ikke bruges her — enten understøtter browseren dem ikke, eller også er serverens adresse en IP frem for et domænenavn, hvilket ingen authenticator accepterer.',
+
+	// --- restarting from the interface ---------------------------------------------
+	'update.restart': 'Genstart og hent nyeste version',
+	'update.restarting': 'Genstarter…',
+	'update.restartQuestion':
+		'Genstart nu? Serveren er nede i omkring et halvt minut, og henter den nyeste version på vejen op.',
+	'update.asking': 'Beder panelet om at genstarte…',
+	'update.waiting': 'Venter på at serveren kommer op igen…',
+	'update.stillDown': 'Serveren er ikke kommet op endnu. Kig i panelet.',
+	'update.notConfigured':
+		'Denne instans kan ikke genstarte sig selv: {missing} er ikke sat. En container kan ikke udskifte sit eget image — panelet gør arbejdet, og det her er kun måden at bede om det.'
 };

web/src/lib/locales/en.js

@@ -630,5 +630,16 @@ export const en = {
 	'passkey.signingIn': 'Waiting for the device…',
 
 	'passkey.unavailable':
-		'Passkeys cannot be used here — either this browser does not support them, or the server’s address is an IP rather than a domain name, which no authenticator will accept.'
+		'Passkeys cannot be used here — either this browser does not support them, or the server’s address is an IP rather than a domain name, which no authenticator will accept.',
+
+	// --- restarting from the interface ---------------------------------------------
+	'update.restart': 'Restart and pull the latest version',
+	'update.restarting': 'Restarting…',
+	'update.restartQuestion':
+		'Restart now? The server is down for about half a minute, and pulls the newest version on the way back up.',
+	'update.asking': 'Asking the panel to restart…',
+	'update.waiting': 'Waiting for the server to come back…',
+	'update.stillDown': 'The server has not come back yet. Have a look in the panel.',
+	'update.notConfigured':
+		'This instance cannot restart itself: {missing} are not set. A container cannot replace its own image — the panel does the work, and this is only the way to ask.'
 };

web/src/routes/indstillinger/notifikationer/+page.svelte

@@ -89,6 +89,55 @@
 
 	let version = $state(null);
 
+	// --- restarting from here ---------------------------------------------------
+
+	let panel = $state(null);
+	let restarting = $state(false);
+	let restartNote = $state('');
+
+	$effect(() => {
+		api
+			.panelStatus()
+			.then((p) => (panel = p))
+			.catch(() => {});
+	});
+
+	/**
+	 * Asks the panel to recreate this container, then waits for it to come back.
+	 *
+	 * The reply may never arrive — the panel stops this container as part of
+	 * answering — so the answer is not believed either way. `/healthz` is polled
+	 * until it responds, which is the only thing that actually says "it is up".
+	 */
+	async function restart() {
+		if (!confirm(t('update.restartQuestion'))) return;
+		restarting = true;
+		restartNote = t('update.asking');
+		try {
+			await api.restartFromPanel();
+		} catch (e) {
+			// A request cut off mid-flight is the successful case wearing a
+			// failure's clothes. The poll below decides.
+			restartNote = humanMessage(e);
+		}
+
+		restartNote = t('update.waiting');
+		for (let i = 0; i < 60; i++) {
+			await new Promise((r) => setTimeout(r, 2000));
+			try {
+				const response = await fetch('/healthz', { cache: 'no-store' });
+				if (response.ok) {
+					location.reload();
+					return;
+				}
+			} catch {
+				// Still down, which is expected for the first few seconds.
+			}
+		}
+		restarting = false;
+		restartNote = t('update.stillDown');
+	}
+
 	$effect(() => {
 		api.version().then((v) => (version = v)).catch(() => {});
 	});
@@ -182,6 +231,20 @@
 			{/if}
 		</p>
 
+		<!-- Restarting is what makes a new version arrive: a container cannot replace
+		     its own image, and the panel pulls `:latest` when it recreates one. The
+		     button is here rather than in another browser tab. -->
+		{#if panel?.configured}
+			<div class="row">
+				<button class="secondary" onclick={restart} disabled={restarting}>
+					{restarting ? t('update.restarting') : t('update.restart')}
+				</button>
+				{#if restartNote}<span class="saved">{restartNote}</span>{/if}
+			</div>
+		{:else if panel}
+			<p class="hint">{t('update.notConfigured', { missing: panel.missing.join(', ') })}</p>
+		{/if}
+
 		{#if version.update_available}
 			{#if version.notes}
 				<p class="notes">{version.notes}</p>