fix(monitoring): repair silent-false-positive update badge + auto-update scheduling

Customer container status checks looked up containers by an exact expected
name. When a docker compose recreate got interrupted (e.g. a hung command
previously killed the whole update-all batch on timeout), Compose could leave
the old container renamed with a random hash prefix instead of removed. The
exact-name lookup then found nothing, returned None, and that silently
counted as "up to date" (green "Aktuell") instead of surfacing as unknown —
affecting 5 customers on the appliance whose containers were actually still
running under orphaned names.

- _run_cmd no longer raises on subprocess timeout, so one stuck customer
  can't abort the rest of a batch update
- repair_container_naming() self-heals orphaned hash-renamed containers by
  renaming them back before every status check and before recreate
- update-all loop now catches per-customer exceptions instead of aborting
- status responses expose "unknown" separately from "needs_update" so the UI
  shows a distinct grey badge instead of a false-positive green one
- new settings: automatic daily update check (on/off + time), with an
  independent toggle for whether it also auto-recreates customer containers

app/models.py

@@ -199,6 +199,12 @@ class SystemConfig(Base):
     git_branch: Mapped[Optional[str]] = mapped_column(String(100), default="main")
     git_token_encrypted: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
 
+    # Automatic NetBird image update check/apply
+    auto_update_check_enabled: Mapped[bool] = mapped_column(Boolean, default=False)
+    auto_update_check_time: Mapped[Optional[str]] = mapped_column(String(5), default="03:00")
+    auto_update_apply_enabled: Mapped[bool] = mapped_column(Boolean, default=False)
+    auto_update_last_run_at: Mapped[Optional[datetime]] = mapped_column(DateTime, nullable=True)
+
     created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
     updated_at: Mapped[datetime] = mapped_column(
         DateTime, default=datetime.utcnow, onupdate=datetime.utcnow
@@ -253,6 +259,12 @@ class SystemConfig(Base):
             "git_repo_url": self.git_repo_url or "",
             "git_branch": self.git_branch or "main",
             "git_token_set": bool(self.git_token_encrypted),
+            "auto_update_check_enabled": bool(self.auto_update_check_enabled),
+            "auto_update_check_time": self.auto_update_check_time or "03:00",
+            "auto_update_apply_enabled": bool(self.auto_update_apply_enabled),
+            "auto_update_last_run_at": (
+                self.auto_update_last_run_at.isoformat() if self.auto_update_last_run_at else None
+            ),
             "created_at": self.created_at.isoformat() if self.created_at else None,
             "updated_at": self.updated_at.isoformat() if self.updated_at else None,
         }