Application update

Purpose: Let an operator move the running application to the latest origin/main without SSH, and never leave the checkout half-updated. Scenario: The maintainer, on a phone, opens Tools → Deploy. The page shows the current commit and, from the last fetch, that it is two commits behind, listing those two commits and the size of the change. They tap Deploy now; the server fetches, sees a clean main that origin/main fast-forwards, moves HEAD, logs the attempt and shows the new commit. The server's own edit to public/.htaccess survives: the deploy stashes it, fast-forwards and reapplies it. Had the update changed the same lines, the deploy would have gone back to the previous commit with the edit intact and named the file to merge over SSH. Queue deploy does the same through the task queue (the page shows how long it has waited for the worker), and ./v3 deploy does it over SSH; all three share one lock and one attempt log. Sources: routine (source unavailable), page and actions (source unavailable), template (source unavailable), page script (source unavailable), CLI (source unavailable), operator guide, tests (source unavailable), page tests (source unavailable).

Boundaries: pull only (no docs publish or static build); only session-authenticated root-approved operators and same-origin requests; opening the page reads local Git state and never fetches.