Add standalone backup script and admin update-check banner

ops/backup.sh snapshots LDAP (slapcat), Redis (BGSAVE, dynamic RDB path
lookup), and ./config for standalone deployments, with retention. A
background service polls GitHub releases every 24h and surfaces an
admin-only banner in the UI when a newer version is published.

nodejs/app.js

@@ -23,6 +23,9 @@ const { router: oauthRouter, authRouter: oauthApiRouter, discovery } = require('
 // Grab the projects PubSub
 app.contoller = require('./controller');
 
+// Background services (self-initializing on require).
+require('./services/update_check');
+
 // Push pubsub over the socket and back.
 app.onListen.push(function(){
   app.io.use(middleware.authIO);
@@ -76,6 +79,7 @@ app.use('/api/token', middleware.auth, require('./routes/token'));
 app.use('/api/group', middleware.auth, require('./routes/group'));
 app.use('/api/service-account', middleware.auth, require('./routes/service_account'));
 app.use('/api/notification', middleware.auth, require('./routes/notification'));
+app.use('/api/update-check', middleware.auth, require('./routes/update_check'));
 
 // Self-service API tokens (PATs) — owner-scoped, no admin group required.
 app.use('/api/api-token', middleware.auth, require('./routes/api_token'));