#1266 Add the Update the engine card

Descripción

This card is only the visible half of the engine updater. The updater itself lives in PR #1265 - the base of
this PR - which adds `serve/update.py`, the `/api/update/check|apply|state` routes, and the docs describing
what the engine update does and how it was measured.

This half adds the card to the About tab: the installed version, the latest release, a **Check for updates**
button, and - only when the server says a newer engine is out - an **Install the update** button. Starting
it shows the nine steps individually with their own status and their own note, and the download percent is
the server's byte count, not a timer. When it finishes, the note reports the engine version the install
actually came back with - not the release tag - because a hotfix release such as v0.1.40.1 ships the v0.1.40
engine, and naming the tag would claim more than happened.

Verified against the live v0.1.40.1 release on this machine in a browser: the card appeared, the check was
established, the download completed at 190.2 MB and the engine restarted and reported its version, and the
backup was left in `engine/.previous` as documented. Two live rendering bugs were found and fixed while
verifying: one missed `bare()` on a tag writer that made the card read `vv0.1.40.1` (fixed at the setter, so
all eight display writers are consistent), and the About polling overwriting the server's tag with
BUILD.json's engine version, which on the v0.1.40.1-ships-v0.1.40 case offered the already-installed update
again.

This is meant to land after #1265, which adds the updater and the routes this card calls. PR base is
`main`, and because the two branches share the core commits, the diff of this PR against `main` shrinks
to just the three web files the moment #1265 merges - that is what GitHub will show, no manual rebase
needed. Until then, `git diff update-core..update-ui` shows exactly the card on its own: three files,
322 added. Nothing outside `serve/web/` is touched.