feat: add per-target update summaries

[Jordan-SkyLF]

Thinking Path

• Hermes WebUI checks for updates in two places: the WebUI checkout and the Hermes Agent checkout.
• The previous banner showed one What's new? action even when both targets had updates. That link only represented the WebUI comparison, so Agent-only updates could still show a What's new? button that did not explain the Agent changes.
• This PR makes the comparison action target-aware: WebUI updates get a WebUI comparison, and Agent updates get an Agent comparison.
• It also adds an opt-in summary mode that can turn each target's diff into a short LLM-generated explanation. After reading the summary, users can still open the original diff for the underlying details.

What Changed

• Adds safe per-target compare_url metadata for WebUI and Agent update checks.
• Renders separate WebUI / Agent What's new actions so each available update links to the correct repository comparison.
• Handles Agent-only and WebUI-only update states without showing a misleading cross-target comparison action.
• Adds an opt-in settings toggle for human-readable update summaries.
• Adds per-target summary generation, structured summary sections, target-scoped diff links, and cached/generated-summary button states across refreshes.
• Extends focused update-banner regression coverage for the diff-link and summary flows.

Why It Matters

The update banner now matches what it claims to show. If WebUI has updates, users can inspect the WebUI diff; if Hermes Agent has updates, users can inspect the Agent diff. Users who do not want to read raw commit diffs can enable summaries, get a simpler explanation first, and still click through to the exact comparison afterward.

Before / After

Before: the simulated dual-target update banner exposed a single What's new? action even though the banner reported both WebUI and Agent updates. That made the action ambiguous and could leave Agent-only changes unexplained.

After, summary setting off: the banner keeps the default raw-diff path and shows separate What's new: WebUI · Agent links.

After, summary setting on: the banner renders separate Generate WebUI update summary and Generate Agent update summary actions. Each summary is scoped to its repository, and the generated-summary panel still keeps the regular diff link available for users who want to inspect the source comparison.

Verification

• GitHub Actions Tests matrix
  • result: passed on Python 3.11, 3.12, and 3.13 for head 7d0a2c
• python -m py_compile api/updates.py api/routes.py api/config.py
  • result: passed
• node --check static/ui.js static/panels.js static/boot.js static/i18n.js
  • result: passed
• node --check static/ui.js
  • result: passed after clarifying the summary-action copy
• python -m pytest -q tests/test_update_banner_fixes.py tests/test_update_checker.py tests/test_updates.py tests/test_update_apply_ui.py tests/test_issue1579_whats_new_link_404.py
  • result: 80 passed
• python -m pytest -q tests/test_update_banner_fixes.py
  • result: 53 passed after clarifying the summary-action copy
• python -m pytest -q tests/test_workspace_blank_page_fix.py::TestBootJsProfileDefaultWorkspace::test_boot_sets_profile_default_workspace_in_settings_block
  • result: passed
• git diff --check origin/master...HEAD
  • result: passed
• Replacement screenshot inspection
  • result: before image plus both after images fully show the update banner borders, default What's new: WebUI · Agent links, Generate WebUI update summary / Generate Agent update summary actions, Later, and Update Now; no private paths or secrets visible
• python -m pytest tests/ -v --timeout=60
  • result: local environment does not have the timeout plugin; pytest exited with unrecognized arguments: --timeout=60
• python -m pytest tests/ -q -x
  • result: 1 failed, 1517 passed, 5 skipped; stopped at the known order-sensitive tests/test_issue1499_keyless_onboarding.py::TestKeylessChatReady::test_lmstudio_keyless_chat_ready_via_full_status
• python -m pytest -q tests/test_issue1499_keyless_onboarding.py::TestKeylessChatReady::test_lmstudio_keyless_chat_ready_via_full_status
  • result: passed in isolation
• Manual browser check on a local branch instance
  • result: summary mode showed separate Generate WebUI update summary / Generate Agent update summary actions, each API call was target-scoped, each generated panel kept only that target's regular diff link, stored summaries changed the button text to View generated ..., changed update SHAs changed it to Re-generate ..., and the browser console was clean

Risks / Follow-ups

• Low to medium risk: this touches update-banner rendering and update-check metadata, but update application logic is unchanged.
• Summary mode is opt-in and the default path remains the regular diff comparison links.
• The local full-suite fallback still shows the existing order-sensitive onboarding failure noted above; the failing test passes in isolation, and the GitHub Actions matrix passes.

Model Used

• OpenAI gpt-5.5 via Hermes Agent / Skyly for implementation, browser verification, and PR preparation.