Add update.sh, persist Go on PATH via profile.d

update.sh pulls the latest main, rebuilds, reinstalls, and restarts
the service in one step. install.sh/bootstrap.sh now also drop
/etc/profile.d/go-path.sh so Go stays on PATH in future shells, not
just within the running install script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

update.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Updates an existing wireguard-ui-multi installation: pulls the latest
+# source, rebuilds, reinstalls the binary/unit, and restarts the service.
+#
+# Usage (as root):
+#   cd /opt/wireguard-ui-multi-src && ./update.sh
+# or from anywhere:
+#   /opt/wireguard-ui-multi-src/update.sh --src-dir /opt/wireguard-ui-multi-src
+set -euo pipefail
+
+SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REF="main"
+RESTART=1
+
+while [[ $# -gt 0 ]]; do
+	case "$1" in
+		--src-dir) SRC_DIR="$2"; shift 2 ;;
+		--ref) REF="$2"; shift 2 ;;
+		--no-restart) RESTART=0; shift ;;
+		-h|--help)
+			echo "Usage: $0 [--src-dir <path>] [--ref <branch>] [--no-restart]" >&2
+			exit 1
+			;;
+		*) echo "Unknown option: $1" >&2; exit 1 ;;
+	esac
+done
+
+if [[ "$(id -u)" -ne 0 ]]; then
+	echo "Must run as root (rebuilds and reinstalls the service)." >&2
+	exit 1
+fi
+
+export PATH="/usr/local/go/bin:/usr/local/bin:$PATH"
+
+if [[ ! -d "$SRC_DIR/.git" ]]; then
+	echo "No git checkout found at $SRC_DIR. Run bootstrap.sh first." >&2
+	exit 1
+fi
+
+echo "Fetching latest $REF..."
+git -C "$SRC_DIR" fetch --depth 1 origin "$REF"
+BEFORE="$(git -C "$SRC_DIR" rev-parse HEAD)"
+git -C "$SRC_DIR" checkout "$REF"
+git -C "$SRC_DIR" reset --hard "origin/$REF"
+AFTER="$(git -C "$SRC_DIR" rev-parse HEAD)"
+
+if [[ "$BEFORE" == "$AFTER" ]]; then
+	echo "Already up to date ($AFTER)."
+else
+	echo "Updated $BEFORE -> $AFTER"
+fi
+
+echo "Rebuilding..."
+cd "$SRC_DIR"
+go mod tidy
+go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi
+
+echo "Reinstalling..."
+bash scripts/install.sh
+
+if [[ "$RESTART" -eq 1 ]]; then
+	if systemctl is-enabled --quiet wireguard-ui-multi.service 2>/dev/null || systemctl is-active --quiet wireguard-ui-multi.service 2>/dev/null; then
+		echo "Restarting wireguard-ui-multi.service to pick up the new binary..."
+		systemctl restart wireguard-ui-multi.service
+		systemctl status --no-pager wireguard-ui-multi.service
+	else
+		echo "Service not enabled/active yet, skipping restart. Start it with:"
+		echo "  systemctl enable --now wireguard-ui-multi.service"
+	fi
+else
+	echo "Skipping restart (--no-restart). Restart manually with:"
+	echo "  systemctl restart wireguard-ui-multi.service"
+fi
+
+echo
+echo "Update complete."