feat(lxc-updates): revamp Updates + Options card + curated hints

Updates tab
- Unified OS + Application update card with per-section Apply buttons
  and a combined "Apply OS + <app>" footer button
- Helper-scripts install detection: uses helper_slug from managed_installs
  cache (hostname fuzzy-match against helpers_cache) so the button
  surfaces even when /usr/bin/update was removed
- Runs the community-scripts helper INSIDE the CT via pct exec so
  build.func picks the silent update path (PHS_SILENT=1) instead of the
  install menu — works with and without /usr/bin/update
- HELPER_SLUG env passthrough from backend to apply_updates.sh: falls
  back to constructing the ct/<slug>.sh URL when the CT no longer
  carries the marker file
- Post-apply state refresh via managed_installs.check_for_updates(force)
  in the /applied hook so the badge updates without a manual reload

Options card
- Rewrote as view / edit mode split with a single Edit button
- Unified apply defaults (snapshot + storage + restart) shared by
  manual and scheduled runs
- Scheduled updates (M5): cron picker + preset dropdown + What-to-update
  target + Delete schedule button, wired to a background scheduler thread
  that fires apply_updates.sh headless with the schedule's env vars
- External host cron detection with variant + scope reporting
  (tteck-legacy / community-scripts / custom, OS-only), shown as an
  informational chip only in edit mode

App tab editor
- Multi-app registration with per-app upstream tracking method
  (github / http_json / docker_hub)
- Card-contrast pattern in edit mode (bg-card + bg-background inputs)
- Auto-heal for missing installed_version via alt_detectors +
  file_fallbacks

Curated tracking hints (M6)
- Add http_json upstream for Plex (plex.tv API)
- Add binary+github hints for Emby (MediaBrowser/Emby.Releases) and
  PhotoPrism (photoprism/photoprism)
- Extend CI merge whitelist with upstream_type / upstream_url /
  upstream_json_path / docker_image

Tab reorder
- LXC modal tabs: Status | App | Updates | Mounts | Backups | Firewall

apply_updates.sh
- New helper execution path: parse ct/<slug>.sh URL, run inside CT
  with PHS_SILENT=1, respecting HELPER_SLUG fallback when
  /usr/bin/update is missing

AppImage/scripts/notification_templates.py

@@ -510,6 +510,27 @@ TEMPLATES = {
         'group': 'vm_ct',
         'default_enabled': False,
     },
+    'lxc_update_applied': {
+        'title': '{hostname}: LXC {ct_name} ({vmid}) update {result}',
+        'body': (
+            'Container {ct_name} (CT {vmid}) — update {result}.\n'
+            'Target: {target}    Duration: {duration}'
+        ),
+        'label': 'LXC update applied',
+        'group': 'vm_ct',
+        'default_enabled': True,
+    },
+    'app_update_available': {
+        'title': '{hostname}: {app_name} update available on CT {vmid}',
+        'body': (
+            '{app_name} on CT {vmid} ({ct_name}) has a new version:\n'
+            '    {installed} → {latest}\n'
+            'Registered via ProxMenux App Watch.'
+        ),
+        'label': 'App update available (App Watch)',
+        'group': 'vm_ct',
+        'default_enabled': False,
+    },
     'vm_start': {
         'title': '{hostname}: VM {vmname} ({vmid}) started',
         'body': 'Virtual machine {vmname} (ID: {vmid}) is now running.',
@@ -1696,6 +1717,8 @@ CATEGORY_EMOJI = {
 EVENT_EMOJI = {
     # VM / CT
     'lxc_updates_available': '\U0001F4E6',     # \uD83D\uDCE6 package \u2014 pending CT updates
+    'lxc_update_applied':   '\u2705',           # \u2705 check \u2014 update applied
+    'app_update_available': '\U0001F195',  # \ud83c\udd95 NEW \u2014 upstream app release
     'vm_start':             '\u25B6\uFE0F',    # play button
     'vm_start_warning':     '\u26A0\uFE0F',     # warning sign - started with warnings
     'vm_stop':              '\u23F9\uFE0F',     # stop button