Add standalone backup script and admin update-check banner

ops/backup.sh snapshots LDAP (slapcat), Redis (BGSAVE, dynamic RDB path
lookup), and ./config for standalone deployments, with retention. A
background service polls GitHub releases every 24h and surfaces an
admin-only banner in the UI when a newer version is published.

nodejs/views/top.ejs

@@ -85,7 +85,25 @@
   	    </div>
   	  </div>
   	</nav>
+
+  	<div id="update-banner" class="alert alert-info alert-dismissible mb-0 rounded-0 text-center" style="display:none; position:fixed; left:0; right:0; z-index:1029;">
+  	  <span id="update-banner-text"></span>
+  	  <button type="button" class="btn-close" onclick="dismissUpdateBanner()"></button>
+  	</div>
+
   	<script type="text/javascript">
+  	  function showUpdateBanner(){
+  	    let $nav = $('nav.fixed-top');
+  	    let $banner = $('#update-banner');
+  	    $banner.css('top', $nav.outerHeight() + 'px').show();
+  	    $('#spa-shell').css('margin-top', ($nav.outerHeight() + $banner.outerHeight()) + 'px');
+  	  }
+  	  function dismissUpdateBanner(){
+  	    $('#update-banner').hide();
+  	    $('#spa-shell').css('margin-top', '');
+  	    sessionStorage.setItem('update-banner-dismissed', '1');
+  	  }
+
   	  $(document).ready(async function(){
 
   	    // Set the correct link to active in the top nav bar
@@ -106,6 +124,18 @@
   	        $('#cl-username-text').text(me.uid);
   	        $('#cl-username').css('display', '');
   	      }
+
+  	      if(await app.auth.memberOf('app_sso_admin', me) && !sessionStorage.getItem('update-banner-dismissed')){
+  	        app.api.get('update-check', function(error, info){
+  	          if(error || !info || !info.updateAvailable) return;
+  	          $('#update-banner-text').html(
+  	            'A newer version of SSO Manager is available: <b>v' + info.latestVersion + '</b> ' +
+  	            '(running v' + info.currentVersion + ') — ' +
+  	            '<a href="' + info.releaseUrl + '" target="_blank" class="alert-link">see what changed</a>.'
+  	          );
+  	          showUpdateBanner();
+  	        });
+  	      }
   	    }else{
   	      $('#cl-login-button').show();
   	    }