fix: 修复在线更新暂存链路并增加全局 API 限流备底

- 新增 server/rate-limit.ts：进程内固定窗口限流器，无数据库写入
- server/app.ts 注册全局 preHandler，仅作用于 /api/*，超限返回 429 与 Retry-After
- 提取 isApiPath 统一 onSend、preHandler 与 404 的路径判断
- 更新任务冲突判定改用 ACTIVE_UPDATE_CONFLICT_SQL，staged/download 产物不再阻塞新任务
- cancelUpdateJob 调用补上 await，避免结果恒为 pending Promise
- server/cli/update.ts 增加特权工作区所有权校验与暂存路径重建逻辑
- 新增 tests/rate-limit.test.ts 与 tests/update-apply-staging.test.ts

tests/update-api.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { chmodSync, existsSync, mkdtempSync, readFileSync, statSync, rmSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, statSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
@@ -8,6 +8,7 @@ import { loadConfig, prepareDataDirectories } from "../server/config.js";
 import { openDatabase } from "../server/db/index.js";
 import { hashPassword } from "../server/security.js";
 import { detectPlatform } from "../server/update.js";
+import { reconcileOrphanedUpdateJobs } from "../server/update-service.js";
 
 describe("更新 API", () => {
   let dataDir: string;