feat(host/deck): one-click source rebuild — the update.sh run as a transient user unit

The U3.1 leg of planning:host-update-from-web-console.md. The Deck's on-device install
gets the Update-now button with no opt-in (user-owned, no root): update.sh --pull runs
under systemd-run --user so the script's own restart of punktfunk-host can't kill it
mid-build (a child in our cgroup would die with us). Outcome without version equality —
which a source rebuild can't promise: a failed build leaves the host alive to report it
(unit watched to failure, log attached); a successful one restarts us, and the new
source_build intent flag makes intent-present-at-boot itself the success signal (the
script only restarts the host after a successful install). The console stops treating
a live long build as a timeout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/src/sections/Host/UpdateCard.tsx

@@ -396,7 +396,9 @@ const ApplyProgress: FC<{
 					/>
 				</div>
 			)}
-			{timedOut && (
+			{/* A live job (e.g. the Deck's tens-of-minutes source rebuild) is not "timed out" —
+			    the warning is for the host being GONE longer than a restart explains. */}
+			{timedOut && !job && (
 				<p className="rounded-md border border-amber-500/40 bg-amber-500/10 p-3 text-sm">
 					{m.update_apply_timeout()}
 				</p>