feat(web,docs): the Update-now flow — password re-entry at the BFF, restart-tolerant progress, same-origin hardening

apply.post.ts intercepts the one proxied route that restarts the host: the console
password is re-verified per apply (login throttle shared, stripped before forwarding) so
a 7-day cookie alone can't do it. New Sec-Fetch-Site same-origin check on every mutating
request (login CSRF included). The card's apply flow: confirm dialog → live-session
force escalation → download/verify/restart progress rendered from the last snapshot
while polls fail (the host and, on Windows, this very server restart mid-flow) →
durable success/failure from last_result. Docs: the one-click section + kill switch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/messages/de.json

@@ -456,5 +456,26 @@
 	"update_disabled": "Update-Prüfungen sind auf diesem Host deaktiviert (PUNKTFUNK_UPDATE_CHECK=0).",
 	"update_error": "Letzte Prüfung fehlgeschlagen:",
 	"update_copy": "Kopieren",
-	"update_copied": "Kopiert"
+	"update_copied": "Kopiert",
+	"update_apply_ready": "Version {version} kann von hier aus installiert werden — der Host lädt, prüft und startet sich selbst neu.",
+	"update_apply_button": "Jetzt aktualisieren",
+	"update_apply_confirm_title": "Host auf {version} aktualisieren?",
+	"update_apply_confirm_body": "Mit dem Konsolen-Passwort bestätigen. Der Host startet am Ende neu; diese Seite verbindet sich selbst wieder.",
+	"update_apply_force_warning": "Gerade läuft eine Streaming-Sitzung — das Update bricht sie ab (wer spielt, fliegt raus). Falls du diese Seite über den Stream siehst, verlierst du ihn ebenfalls.",
+	"update_apply_force_button": "Trotzdem aktualisieren (bricht den Stream ab)",
+	"update_apply_password_label": "Konsolen-Passwort",
+	"update_apply_wrong_password": "Falsches Passwort.",
+	"update_apply_throttled": "Zu viele Versuche — kurz warten und erneut versuchen.",
+	"update_apply_working": "Starte…",
+	"update_apply_timeout": "Der Host hat sich noch nicht zurückgemeldet. Möglicherweise installiert er noch — falls das anhält, den Dienst auf der Maschine und das Installer-Log im punktfunk-Datenverzeichnis prüfen (logs\\update-*.log).",
+	"update_applying_title": "Aktualisiere auf {version}",
+	"update_stage_downloading": "Lade den Installer… {pct}%",
+	"update_stage_downloading_indeterminate": "Lade den Installer…",
+	"update_stage_verifying": "Prüfe den Download…",
+	"update_stage_applying": "Übergabe an den Installer…",
+	"update_stage_restarting": "Der Host startet neu…",
+	"update_stage_reconnecting": "Warte, bis der Host wieder da ist…",
+	"update_result_ok": "Aktualisiert {from} → {to}.",
+	"update_result_failed": "Update auf {to} ist in Phase {stage} fehlgeschlagen.",
+	"update_result_log": "Installer-Log:"
 }

web/messages/en.json

@@ -456,5 +456,26 @@
 	"update_disabled": "Update checks are disabled on this host (PUNKTFUNK_UPDATE_CHECK=0).",
 	"update_error": "Last check failed:",
 	"update_copy": "Copy",
-	"update_copied": "Copied"
+	"update_copied": "Copied",
+	"update_apply_ready": "Version {version} can be installed from here — the host downloads, verifies, and restarts itself.",
+	"update_apply_button": "Update now",
+	"update_apply_confirm_title": "Update the host to {version}?",
+	"update_apply_confirm_body": "Confirm with the console password. The host will restart at the end; this page reconnects by itself.",
+	"update_apply_force_warning": "A streaming session is live right now — updating will drop it (whoever is playing gets cut off). If that stream is how you're viewing this page, you'll lose it too.",
+	"update_apply_force_button": "Update anyway (drops the stream)",
+	"update_apply_password_label": "Console password",
+	"update_apply_wrong_password": "Wrong password.",
+	"update_apply_throttled": "Too many attempts — wait a moment and try again.",
+	"update_apply_working": "Starting…",
+	"update_apply_timeout": "The host hasn't come back yet. It may still be installing — if this persists, check the service on the machine and the installer log under the punktfunk data directory (logs\\update-*.log).",
+	"update_applying_title": "Updating to {version}",
+	"update_stage_downloading": "Downloading the installer… {pct}%",
+	"update_stage_downloading_indeterminate": "Downloading the installer…",
+	"update_stage_verifying": "Verifying the download…",
+	"update_stage_applying": "Handing over to the installer…",
+	"update_stage_restarting": "The host is restarting…",
+	"update_stage_reconnecting": "Waiting for the host to come back…",
+	"update_result_ok": "Updated {from} → {to}.",
+	"update_result_failed": "Update to {to} failed during {stage}.",
+	"update_result_log": "Installer log:"
 }