feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/templates/updates.html

@@ -0,0 +1,17 @@
+{{define "body"}}<section class="card">
+  <h1>Updates</h1>
+  <p class="muted">Current binary version compared against the latest release. When <code>WORKER_RELEASE_URL</code> is unset the "latest known" cell shows the placeholder <code>v1 (dev)</code>. Pull and restart stays disabled until Docker management lands (requires sudo / docker socket access).</p>
+  <dl>
+    <dt>Current version</dt><dd><code>{{.CurrentVersion}}</code></dd>
+    <dt>Latest known</dt><dd><code>{{.LatestKnown}}</code></dd>
+    <dt>In sync?</dt><dd>
+      {{if eq .CurrentVersion .LatestKnown}}
+        <span class="ok">yes</span>
+      {{else}}
+        <span class="warn">update available</span>
+      {{end}}
+    </dd>
+  </dl>
+  <button type="button" disabled title="{{.PullTooltip}}">Pull and restart</button>
+  <p class="muted">{{.PullTooltip}}</p>
+</section>{{end}}