fix(monitoring): repair silent-false-positive update badge + auto-update scheduling

Customer container status checks looked up containers by an exact expected
name. When a docker compose recreate got interrupted (e.g. a hung command
previously killed the whole update-all batch on timeout), Compose could leave
the old container renamed with a random hash prefix instead of removed. The
exact-name lookup then found nothing, returned None, and that silently
counted as "up to date" (green "Aktuell") instead of surfacing as unknown —
affecting 5 customers on the appliance whose containers were actually still
running under orphaned names.

- _run_cmd no longer raises on subprocess timeout, so one stuck customer
  can't abort the rest of a batch update
- repair_container_naming() self-heals orphaned hash-renamed containers by
  renaming them back before every status check and before recreate
- update-all loop now catches per-customer exceptions instead of aborting
- status responses expose "unknown" separately from "needs_update" so the UI
  shows a distinct grey badge instead of a false-positive green one
- new settings: automatic daily update check (on/off + time), with an
  independent toggle for whether it also auto-recreates customer containers

static/lang/en.json

@@ -327,7 +327,18 @@
     "updating": "Updating…",
     "updateAllProgress": "Updating customer containers one by one — please wait…",
     "pulling": "Pulling…",
-    "pullStartedShort": "Pull started in background."
+    "pullStartedShort": "Pull started in background.",
+    "statusUnknown": "Unknown",
+    "statusUnknownHint": "Container could not be matched reliably (e.g. not running). Not a verified \"up to date\".",
+    "autoUpdateTitle": "Automatic Updates",
+    "autoUpdateHint": "Automatically checks for new NetBird images daily at the chosen time.",
+    "autoUpdateCheckEnabled": "Enable automatic update check",
+    "autoUpdateCheckTime": "Daily check time",
+    "autoUpdateApplyEnabled": "Automatically update customer containers after check",
+    "autoUpdateApplyHint": "When enabled, all customer containers are automatically recreated after a new image is found (services briefly restart). When disabled, only the images are pulled — updating customers stays a manual step.",
+    "autoUpdateLastRun": "Last automatic check",
+    "autoUpdateNever": "Never run",
+    "saveAutoUpdateSettings": "Save Automation"
   },
   "userModal": {
     "title": "New User",