feat(update): 主机每日记录组件版本比对，面板更新页展示可用更新与应用命令

internal/api/api.go

@@ -663,10 +663,12 @@ func (a *API) externalAPIRoutes() []apiRoute {
 		{Method: "GET", Pattern: "/api/v1/submissions/{id}/context", Admin: true, h: a.handleAdminSubmissionContext},
 		// Auto-update maintenance window (spec §B; decision core internal/updates).
 		// Admin-tier: it governs whether Felis may apply an update to itself, so setting
-		// it requires the admin Zero-Trust path, not a mere session. API+persistence
-		// only — the runner/executors that consume the window are still INTEGRATION-ONLY.
+		// it requires the admin Zero-Trust path, not a mere session. Advisory: `felis
+		// update` on the host reads it and warns before an apply outside it.
 		{Method: "GET", Pattern: "/api/v1/updates/window", Admin: true, h: a.handleGetUpdateWindow},
 		{Method: "PUT", Pattern: "/api/v1/updates/window", Admin: true, h: a.handleSetUpdateWindow},
+		// The newest version check felis-update-check.timer recorded on the host.
+		{Method: "GET", Pattern: "/api/v1/updates/report", Admin: true, h: a.handleGetUpdateReport},
 		// Control-plane database backup freshness, as the host's felis-db-backup.timer
 		// last recorded it. Admin-tier: it names the host backup directory.
 		{Method: "GET", Pattern: "/api/v1/platform/db-backup", Admin: true, h: a.handleGetDBBackup},