feat(netbird): central control of client Automatic Updates across all customers

Lets the MSP admin control NetBird's own "Settings > Clients > Automatic
Updates" feature (client/peer auto-update, v0.61.0+) for every customer from
one place, instead of logging into each customer's dashboard individually.

- New deployments automatically capture a Personal Access Token during the
  existing /api/setup bootstrap call (create_pat=true), requiring
  NB_SETUP_PAT_ENABLED=true on the management container (now set by default
  in the compose template). Token is encrypted at rest per customer.
- Existing customers (deployed before this existed) can have a token pasted
  in manually from their own dashboard — verified before being stored.
- Settings > Docker Images: master default (version + force-update toggle)
  plus "Apply to All Customers" which pushes it to everyone with a token.
- Customer detail page: shows the customer's live current setting (read
  from their NetBird API, not cached) with per-customer override or
  "sync from default".
- New app/services/netbird_client_update_service.py wraps the customer's
  NetBird Management API (GET/PUT /api/accounts) for this.

static/lang/en.json

@@ -91,7 +91,27 @@
     "lastCheck": "Last check: {time}",
     "openDashboard": "Open Dashboard",
     "updateImages": "Update Images",
-    "updateInProgress": "Updating containers — please wait…"
+    "updateInProgress": "Updating containers — please wait…",
+    "netbirdClientUpdates": "NetBird Client Auto-Updates",
+    "nbuNoToken": "No API token registered for this customer. New deployments capture one automatically — for existing customers, create a Personal Access Token once in their dashboard (Settings → Service Users) and paste it here.",
+    "nbuTokenPlaceholder": "Paste Personal Access Token…",
+    "nbuSaveToken": "Verify & Save",
+    "nbuTokenSaved": "Token saved.",
+    "nbuVersion": "Client version",
+    "nbuDisabled": "Disabled",
+    "nbuLatest": "Latest version",
+    "nbuCustom": "Specific version",
+    "nbuForce": "Force automatic updates",
+    "nbuSave": "Save",
+    "nbuSyncMaster": "Sync from default",
+    "nbuSaved": "Setting applied.",
+    "nbuSynced": "Default setting applied.",
+    "nbuVersionRequired": "Please specify a version.",
+    "nbuMasterTitle": "NetBird Client Auto-Updates (all customers)",
+    "nbuMasterHint": "Controls the \"Automatic Updates\" setting inside every customer's own NetBird dashboard (Settings → Clients). Set the default here, then push it to all customers at once. Individual customers can still be overridden from their detail page.",
+    "nbuSaveDefault": "Save Default",
+    "nbuApplyAll": "Apply to All Customers",
+    "nbuConfirmApplyAll": "Apply this update setting to every customer with a registered API token?"
   },
   "customerModal": {
     "newCustomer": "New Customer",