fix(hub): reconcile completed updates after polling stalls

The full-system updater runs as a detached systemd service and can finish
successfully even when the browser loses its status connection. In that
case the update log and status file correctly report REBOOT_REQUIRED, but
the Hub modal can remain on "Updating..." with its controls disabled.

There were four independent ways for the frontend to get stuck:

* update status fetches had no deadline, so a request that stayed pending
  never rejected and never advanced the existing failure counter;
* setInterval started async polls without waiting for the previous poll,
  allowing slow requests to overlap and responses to arrive out of order;
* each log chunk used textContent +=, replacing the complete and growing
  Nix build log every two seconds, which could stall browser rendering and
  was especially visible over RDP; and
* page reload, tab resume, and RDP reconnect did not reattach the modal to
  the update status persisted by the backend.

This produced a dangerous UX mismatch: the machine had a fully staged
NixOS generation and was ready to reboot, while the Hub continued telling
the user that the update was still running.

Bound status requests with AbortController, prevent overlapping polls, and
replace the endless spinner after sustained failures with an explicit
"Update status unavailable" state and Retry Status action. Reconcile state
immediately on focus, visibility, online, page startup, and before starting
a new update. Use no-store requests and render verbose logs incrementally
with a bounded visible tail while retaining the complete report in memory.
Apply the same timeout and single-flight protection to rebuild polling.

Record the exact generation produced by `nixos-rebuild boot`. The Hub now
keeps REBOOT_REQUIRED visible until that generation matches
/run/current-system, then clears the marker after reboot. For an update
started by an older updater that did not write the marker, recover the
staged generation from the final nixos-rebuild log line. The dashboard
sidebar also distinguishes update-in-progress and restart-required states.

Regression coverage verifies generation marker/log recovery, pre- versus
post-reboot detection, request timeout wiring, single-flight polling,
connection-loss UX, RDP/tab resume reconciliation, bounded log rendering,
page-reload recovery, and JavaScript syntax.

Validation:
* python3 -m unittest discover -s tests -p 'test_*.py' -v (170 passed)
* node --check app/sovran_systemsos_web/static/js/*.js
* python3 -m py_compile for changed Python modules
* git diff --check

A Nix evaluation was not available in the development sandbox; the NixOS
module should still be evaluated and built in CI or on a test machine before
release.

app/sovran_systemsos_web/server.py

@@ -55,6 +55,7 @@ from .security_helpers import (
     load_session_store,
     save_session_store,
 )
+from .update_state import staged_generation_is_active
 
 logger = logging.getLogger(__name__)
 
@@ -64,9 +65,10 @@ FLAKE_LOCK_PATH = "/etc/nixos/flake.lock"
 FLAKE_INPUT_NAME = "Sovran_Systems"
 GITEA_API_BASE = "https://git.sovransystems.com/api/v1/repos/Sovran_Systems/Sovran_SystemsOS/commits"
 
-UPDATE_LOG    = "/var/log/sovran-hub-update.log"
-UPDATE_STATUS = "/var/log/sovran-hub-update.status"
-UPDATE_UNIT   = "sovran-hub-update.service"
+UPDATE_LOG        = "/var/log/sovran-hub-update.log"
+UPDATE_STATUS     = "/var/log/sovran-hub-update.status"
+UPDATE_GENERATION = "/var/log/sovran-hub-update.generation"
+UPDATE_UNIT       = "sovran-hub-update.service"
 
 REBUILD_LOG    = "/var/log/sovran-hub-rebuild.log"
 REBUILD_STATUS = "/var/log/sovran-hub-rebuild.status"
@@ -1634,15 +1636,6 @@ def _nwc_lnurl_bech32(alias: str, domain: str) -> str:
 
 # ── Update helpers (file-based, no systemctl) ────────────────────
 
-def _read_update_status() -> str:
-    """Read the status file. Returns RUNNING, SUCCESS, REBOOT_REQUIRED, FAILED, or IDLE."""
-    try:
-        with open(UPDATE_STATUS, "r") as f:
-            return f.read().strip()
-    except FileNotFoundError:
-        return "IDLE"
-
-
 def _write_update_status(status: str):
     """Write to the status file."""
     try:
@@ -1652,6 +1645,34 @@ def _write_update_status(status: str):
         pass
 
 
+def _read_update_status() -> str:
+    """Read and reconcile the persistent update status.
+
+    ``REBOOT_REQUIRED`` intentionally survives Hub/browser restarts before the
+    reboot.  Once the staged generation is the running ``/run/current-system``,
+    clear that marker so a completed reboot cannot leave the Hub asking for
+    another reboot forever.  The generation helper can recover older updates
+    from the final nixos-rebuild log line when no explicit marker exists.
+    """
+    try:
+        with open(UPDATE_STATUS, "r") as f:
+            status = f.read().strip()
+    except FileNotFoundError:
+        return "IDLE"
+
+    if status == "REBOOT_REQUIRED" and staged_generation_is_active(
+        UPDATE_GENERATION, UPDATE_LOG
+    ):
+        _write_update_status("IDLE")
+        try:
+            os.remove(UPDATE_GENERATION)
+        except OSError:
+            pass
+        return "IDLE"
+
+    return status
+
+
 def _read_log(offset: int = 0) -> tuple[str, int]:
     """Read the update log file from the given byte offset.
     Returns (new_text, new_offset)."""
@@ -3832,9 +3853,15 @@ async def api_ports_health():
 @app.get("/api/updates/check")
 async def api_updates_check():
     loop = asyncio.get_event_loop()
+    status = await loop.run_in_executor(None, _read_update_status)
+    if status in {"RUNNING", "REBOOT_REQUIRED"}:
+        # Avoid a slow remote update check when there is already an operation
+        # the dashboard needs to surface.
+        return {"available": True, "status": status.lower()}
+
     available = await loop.run_in_executor(None, check_for_updates)
     # None means inconclusive (check failed) — report as available so the UI doesn't block
-    return {"available": available is not False}
+    return {"available": available is not False, "status": status.lower()}
 
 
 @app.get("/api/ping")