feat(ui): free-form branch input in UpdateCard

[ng]

Problem

sp-update <branch> accepts any branch and the tRPC system.triggerUpdate({ branch }) mutation already validates + forwards it. But UpdateCard.tsx only offers a main / dev picker for non-standard branches — there's no way to install a feature branch (e.g. feat/sp-bundle-logs) from the UI without SSHing in.

This came up testing #580 — to dogfood the new `sp-bundle-logs` from a real install, the only paths today are:

1. ssh in and run sudo sp-update feat/sp-bundle-logs
2. scripts/deploy <pod> feat/sp-bundle-logs from a dev machine

A textbox-or-dropdown for arbitrary branch would let support / contributors run unreleased branches without leaving the web UI.

Proposal

In src/components/status/UpdateCard.tsx:

• Add a "Custom branch…" option to the branch-picker step alongside main / dev
• Render a text input when selected; validate against the same ^[a-zA-Z0-9._\-/]+$ regex used in system.triggerUpdate
• Same WAN-unblock prompt + restart flow as standard updates
• Show a clear warning that custom branches are unreleased

Acceptance

• Branch picker shows three options: main, dev, custom
• Custom input validates the branch name client-side before submit
• Submitting an invalid branch (e.g. evil; rm -rf /) is rejected with a usable error
• Service restarts and reconnects same as standard update path
• Existing main/dev flow unchanged

Refs

• PR feat(sp-bundle-logs): one-shot diagnostic capture for support handoffs #580 (sp-bundle-logs) — surfaced the need
• src/server/routers/system.ts:269 triggerUpdate already does the heavy lifting
• src/components/status/UpdateCard.tsx:54 isStandardBranch is where the picker decision lives