Updates tab (apt list/refresh/upgrade/changelog, reboot flag) on a new background tasks package with live WS streaming; header power button with hostname confirmation

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

PLAN.md

@@ -119,6 +119,18 @@ something long in one, switch away and back, refresh — it's all still there.
 
 ## Roadmap (not MVP — notes only)
 
+- **Updates tab** — **shipped 2026-09-17** (`internal/updates`, `internal/tasks`,
+  `Updates.tsx`): upgradable packages with current → candidate, suite, security badge
+  and description; index age, last upgrade (from `/var/log/apt/history.log`),
+  unattended-upgrades on/off, reboot-required banner with the packages that caused it;
+  Refresh index, Upgrade all (dist-upgrade), Upgrade selected; changelog per package on
+  demand. Runs go through the new **tasks** package: background command, output kept,
+  followed live over `/api/tasks/{id}/stream`, cancellable, listed at `/api/tasks` (the
+  seed of a Task History tab). apt is fully supported; dnf/pacman list only.
+- **Power** — header ⏻ button (amber when a reboot is pending), dialog that requires the
+  hostname typed back, then `systemctl reboot` / `poweroff`. `/api/me` carries
+  `reboot_needed` so the header knows.
+
 - **tmux-backed sessions** so shells survive a daemon restart / redeploy. Would spawn
   `tmux new -A -s hamlab-<id>`; needs `mouse on` and status-bar handling in xterm.
 - **Services tab** — `systemctl list-units`, per-unit page: status, last 200 journal