Add read-only OS package update status (apt) on the About page

New system package checks `apt list --upgradable` against the current
package index (no apt update triggered) and the reboot-required marker
file. Read-only - never installs or upgrades anything. Shown as a card
on the About page with a manual "Check now" refresh.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

handler/routes.go

@@ -29,6 +29,7 @@ import (
 	"github.com/ngoduykhanh/wireguard-ui/firewall"
 	"github.com/ngoduykhanh/wireguard-ui/model"
 	"github.com/ngoduykhanh/wireguard-ui/store"
+	"github.com/ngoduykhanh/wireguard-ui/system"
 	"github.com/ngoduykhanh/wireguard-ui/telegram"
 	"github.com/ngoduykhanh/wireguard-ui/util"
 )
@@ -1770,3 +1771,11 @@ func AboutPage() echo.HandlerFunc {
 		})
 	}
 }
+
+// GetSystemUpdateStatus reports pending OS package updates (Debian/Ubuntu
+// via apt), read-only - nothing is installed or upgraded.
+func GetSystemUpdateStatus() echo.HandlerFunc {
+	return func(c echo.Context) error {
+		return c.JSON(http.StatusOK, system.CheckAptUpdates())
+	}
+}