SKY: disable auto slew-preview (collided with slew-and-center capture)

The SlewPreviewService starts a camera video stream while the mount
slews. On the SV605CC that video stream collided with the still capture
slew-and-center fires the instant the slew finishes: the driver returned
an empty/zero-dimension BLOB during the video->still transition, which
crashed FITSReader ("toExclusive ('0') must be greater than '0'") and
failed centering. The feature has no persistence/endpoint, so flip the
default to disabled until the transition is made race-free.

Also harden FITSReader.ReadPixelData against a 0-pixel image: throw a
clear InvalidDataException instead of letting Partitioner.Create(0, 0)
throw the cryptic out-of-range error, so any empty/malformed frame from
any driver surfaces a readable message.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Update modal: show commit changelog since installed version (not rele…

…ase body)

The release body is download/install instructions, which is noise in the
in-app updater. Instead, list the actual commits between the installed
version's tag and the release tag.

Backend: UpdateService.CheckAsync now calls the GitHub compare API
(v{installed}...{releaseTag}) and returns Commits[] (sha + subject + body),
newest first, skipping "Bump version" commits and stripping Co-Authored-By
/ generation-footer trailers. Best-effort: empty list if the compare 404s
(e.g. a dev build with no matching tag).

Frontend: the modal renders update.commits as a compact list (short sha +
bold subject + muted body) styled with the design tokens, replacing the
markdown release-notes block. Falls back to "Changelog unavailable" when
empty.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Fix AUTORUN/sequence frames leaking onto the LIVE canvas

Sequence captures (classic AUTORUN via SequenceEngine and the ADV tree via
CameraInstructions) were relayed as FrameKind.Live, and the client fanned
Live frames out to BOTH liveCanvas and autorunCanvas — so a running
sequence's frames appeared on the LIVE tab (and, symmetrically, the LIVE
live-stack output bled into the AUTORUN preview).

Give sequence captures their own FrameKind.Autorun (=5) that the client
routes to autorunCanvas only, and drop autorunCanvas from the Live (kind 0)
target list so Live renders to liveCanvas only. LIVE and AUTORUN previews
are now fully isolated. PREVIEW (kind 1 → previewCanvas) was already
correct.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Update modal: render release notes as formatted Markdown

The release-notes panel showed the raw GitHub markdown as preformatted
text (## headings, ```code fences```, [links](...) all literal). Add a
small dependency-free renderMarkdown() helper and bind the panel via
x-html so headings, bold/italic, inline + fenced code, lists and links
render properly.

Security: the source is HTML-escaped before any markdown transform, only
known tags are introduced, and links are restricted to http(s), so an
untrusted release body cannot inject markup. Added scoped .update-notes
CSS for heading/list/code styling.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AUTORUN: make MF/Dither/End panel span full width below its tab header

The .seq-dither-panel had 16px horizontal margins while its own
.livestack-trig-tabs header above is full-width, so the panel looked
inset / narrower than necessary. Drop the side margins so it aligns
with the tab strip edges.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Make VIDEO/GUIDE side panels + AUTORUN list column drag-resizable

Extend the LIVE/PREVIEW resize pattern to the other side panels and columns:
- Generalize the resizer into _panelResize(varName, key, def, min, max, dir)
  with per-panel wrappers + _restorePanelWidths() restoring all on boot.
- VIDEO floating panel: width var --video-qc-width + left-edge grip.
- GUIDE side panel: width var --guide-side-width + left-edge grip.
- AUTORUN list column: width var --autorun-list-w driven by a flex
  .col-splitter between the list and the cards rail (in-flow columns can't
  use an overlay grip — it would scroll away — so a flex splitter is used,
  with dir='right' since the column is left of the grip).
All widths clamp to sane bounds, persist to localStorage, and dispatch a
resize event on release so canvases re-fit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Annotate: size the marker ring to the object's catalog angular size

The STUDIO annotation overlay drew a fixed-size dot at each object, so a
big nebula and a tiny galaxy looked the same. Now the marker is a ring
scaled to the object's catalog size.

- Backend: ProjectAnnotationsAsync emits radiusPx = half the object's
  major-axis (sizeArcmin) through the solved plate scale.
- STUDIO (_renderStudioAnnotations): add a ring overlay placed via an
  image-space rectangle so it zooms WITH the image and hugs the object;
  the dot is dropped when a sized ring is shown (label kept, fixed-size +
  readable at any zoom). Objects with no catalog size fall back to the dot.
- .osd-annot-ring CSS. Cache-bust 20260616-annotsize.

(The LIVE/PREVIEW overlay already sized its circle from sizeArcmin.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add SBC self-update: GitHub-release badge + one-click .deb install

When Polaris runs from the Linux .deb, a green 'Update' badge appears in
the top status bar once GitHub has a newer release for the host's
architecture. Clicking it opens a modal with the release notes and a
'Download & install' button that fetches the matching polaris_*_<arch>.deb
and installs it, then reloads the browser on the new version.

UpdateService (Services/External) checks the GitHub releases API (cached
30 min, arch-matched asset, System.Version compare) and installs by
staging the .deb to ~/.cache and starting the on-demand
polaris-self-update.service unit. That unit installs in its own cgroup so
it survives the polaris.service restart the package's postinst triggers.

The service runs as the unprivileged 'polaris' system user, so the
install is authorized passwordless via a new PolicyKit rule
(50-polaris-update.rules: manage-units for that one unit) — the same
pattern as the existing power / clock / NetworkManager rules. No sudo
password is needed.

- Backend: UpdateService + /api/update/check + /api/update/install,
  registered in Program.cs (AddHttpClient + AddSingleton).
- Packaging: polaris-self-update.service, polaris-self-update.sh,
  50-polaris-update.rules; build-deb.sh perms.
- Frontend: update state + checkUpdate()/installUpdate()/poll+reload,
  status-bar badge, modal; cache-bust 20260616-autoupd.
- Tests: UpdateServiceTests (arch/version/unsupported/refusal), 5 passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

SKY: persist constellation lines + figures toggles

Save skyConstLines / skyConstArt to localStorage (nina-sky-cons-lines /
nina-sky-cons-art) and restore on load, same load+$watch pattern as the
ecliptic toggle. A saved choice wins over the defaults (lines on,
figures off); the sky init already re-pushes both to the engine.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

PolarAlign: precess J2000 plate-solve coords to date (fixes ~0.35deg …

…bias)

ASTAP returns J2000 but the polar-axis fit works in the of-date Alt/Az
frame (LST-based), and the ideal pole it compares against is the true
pole of date. Feeding J2000 straight in biased the whole TPPA 3-point set
by the accumulated precession since 2000 (~0.35deg in 2026) -> a real
systematic polar-error offset far larger than the arcminute alignment
goal.

- New PolarAlignmentMath.PrecessJ2000ToDate (Meeus ch.21 rigorous
  precession; nutation/aberration omitted, <25" and dependency-free).
  Kept OUT of ComputeError so its of-date contract (and the synthetic
  unit tests) stay intact — precession is applied at the service boundary
  where J2000 enters.
- TPPA + refine: precess each solved point J2000->date before building
  the PolarPoint.
- Rudimentary: the error math compares J2000 target vs J2000 solve (epoch
  cancels, unchanged), but the SLEW sent raw J2000 to INDI EOD (JNow),
  mispointing ~0.35deg and reading it as polar error that never zeroes.
  Now precesses the target J2000->JNow for the slew.

+2 unit tests (J2000 identity, ~26yr shift magnitude). 14/14 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>