Add Software Update, across packages, applications and firmware

Three sources that fail independently, so they are counted and applied
separately: a flatpak mirror being down says nothing about whether a
kernel security fix is waiting. Blending them into one number would hide
exactly the case that matters.

Checking costs about nine seconds, which is too long to spend every time
a page opens, so the page opens on the last result and says when it was
taken. A first visit with nothing cached goes and finds out rather than
showing a confident "up to date" it has no basis for.

Installing packages takes a snapshot first, named after what is about to
happen, so Snapshots shows "before 32 package updates" rather than a
timestamp. Best effort: a machine without snapper still updates, because
an update that refuses to run when a nicety fails would be worse than
one without a restore point.

Automatic updates cover applications only, through a Panama-owned user
timer running daily with a randomized delay. Packages still ask, and
dnf-automatic is reported as absent rather than offered, because
installing software is not a settings action.

Health gained a check, and that is where the bug was: it first returned
status "degraded", which is not in the doctor's vocabulary of ok,
warning, error and unconfigured. It was counted as nothing at all while
the summary still said healthy -- the same silent no-op this codebase
keeps relearning. A contract now asserts every status a check can return
is one the doctor counts, and the doctor's own contract knows about the
new check rather than failing on its arrival.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/local/share/systemd/user/panama-flatpak-update.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Update Flatpak applications
+Documentation=https://github.com/gibbyb/Panama
+# Pointless without a network, and a failure here is noise rather than news.
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# --noninteractive so it never waits for an answer nobody is there to give.
+# No --system: this updates the user installation, which needs no privilege.
+ExecStart=/usr/bin/flatpak update --assumeyes --noninteractive
+# An update that cannot reach the network should not be reported as a failure
+# every hour; the timer will try again.
+SuccessExitStatus=0 1

config/local/share/systemd/user/panama-flatpak-update.timer

@@ -0,0 +1,17 @@
+[Unit]
+Description=Update Flatpak applications daily
+Documentation=https://github.com/gibbyb/Panama
+
+[Timer]
+# Daily rather than hourly: applications are not a security boundary the way
+# packages are, and a download starting while someone is gaming is worse than
+# an application being a day out of date.
+OnCalendar=daily
+# Catches machines that were off at the scheduled time, which a desktop
+# frequently is.
+Persistent=true
+# So several machines do not all wake and download at once.
+RandomizedDelaySec=30m
+
+[Install]
+WantedBy=timers.target