feat(netbird): central control of client Automatic Updates across all customers

Lets the MSP admin control NetBird's own "Settings > Clients > Automatic
Updates" feature (client/peer auto-update, v0.61.0+) for every customer from
one place, instead of logging into each customer's dashboard individually.

- New deployments automatically capture a Personal Access Token during the
  existing /api/setup bootstrap call (create_pat=true), requiring
  NB_SETUP_PAT_ENABLED=true on the management container (now set by default
  in the compose template). Token is encrypted at rest per customer.
- Existing customers (deployed before this existed) can have a token pasted
  in manually from their own dashboard — verified before being stored.
- Settings > Docker Images: master default (version + force-update toggle)
  plus "Apply to All Customers" which pushes it to everyone with a token.
- Customer detail page: shows the customer's live current setting (read
  from their NetBird API, not cached) with per-customer override or
  "sync from default".
- New app/services/netbird_client_update_service.py wraps the customer's
  NetBird Management API (GET/PUT /api/accounts) for this.

templates/docker-compose.yml.j2

@@ -20,6 +20,11 @@ services:
     image: {{ netbird_management_image }}
     container_name: netbird-{{ subdomain }}-management
     restart: unless-stopped
+    environment:
+      # Allows the MSP appliance to request a Personal Access Token during the
+      # one-time /api/setup bootstrap call. The endpoint itself locks down
+      # (412) as soon as the first user exists, so leaving this on is safe.
+      - NB_SETUP_PAT_ENABLED=true
     networks:
       - {{ docker_network }}
     volumes: