feat(update): felis update 报告 JRE 与 PostgreSQL（含停更提示），bootstrap 支持 FELIS_UPGRADE_DEPS=1 升级 k3s/cloudflared

docs/operations.md

@@ -222,13 +222,36 @@ the version they were installed with unless noted:
 |---|---|---|
 | Velocity, Limbo, Paper, LuckPerms | follow `deploy/game-stack.lock` | rerun after a release that moves the lock (§15b) |
 | Temurin JRE | moves to the pinned patch build | rerun |
-| k3s | left alone | by hand, one minor version at a time: `curl -sfL https://get.k3s.io \| INSTALL_K3S_VERSION=<version> sh -` |
-| cloudflared | left alone | replace `/usr/local/bin/cloudflared` with the release binary, then `systemctl restart cloudflared-felis` |
-| PostgreSQL | the distribution's package | the package manager; a major version needs `pg_upgrade` first (the installer refuses to start a newer server on an older cluster) |
+| k3s | left alone | rerun with `FELIS_UPGRADE_DEPS=1`: moves to the pinned release through that tag's install script, one minor version at a time (a bigger jump stops before anything changes and names the release to go through), never backwards |
+| cloudflared | left alone | rerun with `FELIS_UPGRADE_DEPS=1`: swaps `/usr/local/bin/cloudflared` for the pinned, sha256-checked release and restarts `cloudflared-felis`; a cloudflared the distribution installed stays with its package manager |
+| PostgreSQL | the distribution's package | the package manager for a minor release; a major version needs `pg_upgrade` first (below) |
 | Docker, git, nftables | distribution packages | the package manager |
 
-`sudo felis update` reports Felis, Velocity, k3s and cloudflared against their newest
-releases.
+```sh
+curl -fsSL https://raw.githubusercontent.com/FelisMC/Felis/main/deploy/bootstrap.sh \
+  | sudo FELIS_UPGRADE_DEPS=1 bash
+```
+
+`sudo felis update` reports Felis, Velocity, k3s, cloudflared, the JRE and PostgreSQL
+against their newest releases; `--k3s`, `--cloudflared`, `--jre` and `--postgres` narrow
+it to one. PostgreSQL is compared within its major, since a minor release is a package
+update, and a major past its end of life gets a note naming the current one.
+
+### PostgreSQL major versions [CODE-ONLY]
+
+The installer takes the major the distribution ships (13 on EL9) and never moves it. To
+go to a newer one, stop the writers, keep a dump, then use the distribution's upgrade
+path:
+
+```sh
+sudo k3s kubectl -n felis scale deploy/felis-api deploy/felis-operator --replicas=0
+sudo -u postgres pg_dumpall > /root/felis-pg-$(date +%F).sql
+# EL9: sudo systemctl stop postgresql; sudo dnf module switch-to postgresql:16
+#      sudo dnf install postgresql-upgrade; sudo postgresql-setup --upgrade
+# Debian/Ubuntu: sudo pg_upgradecluster <old-major> main
+sudo systemctl start postgresql
+sudo k3s kubectl -n felis scale deploy/felis-api deploy/felis-operator --replicas=1
+```
 
 ## 5. Disaster recovery
 

docs/troubleshooting.md

@@ -1320,8 +1320,8 @@ Two properties of the control plane matter when you do:
 | Download | Check |
 |---|---|
 | `felis-linux-<arch>` (release channel) | its sha256 must match the release's `SHA256SUMS`; a release without one, or a mismatch, is compiled from the same tag instead |
-| k3s (fresh install only) | the install script is read at `FELIS_K3S_VERSION`'s tag (default `v1.36.4+k3s1`), and it checks the binary against that release's sha256 list |
-| cloudflared (when absent) | release `FELIS_CLOUDFLARED_VERSION` (default `2026.9.1`) against a pinned sha256; another version needs `FELIS_CLOUDFLARED_SHA256` |
+| k3s (fresh install, or `FELIS_UPGRADE_DEPS=1`) | the install script is read at `FELIS_K3S_VERSION`'s tag (default `v1.36.4+k3s1`), and it checks the binary against that release's sha256 list |
+| cloudflared (when absent, or `FELIS_UPGRADE_DEPS=1`) | release `FELIS_CLOUDFLARED_VERSION` (default `2026.9.1`) against a pinned sha256; another version needs `FELIS_CLOUDFLARED_SHA256` |
 | Go toolchain (nano, source builds) | pinned sha256 per architecture; another version needs `FELIS_GO_SHA256` |
 | the registry image | pinned by digest (`registry:2.8.3@sha256:a3d8…`) |
 | Limbo, its spawn schematic, Paper, LuckPerms, Velocity | the builds and sha256s in `deploy/game-stack.lock`; each image build and the proxy install refuse a download that hashes differently (§15b) |