Wire update channel (stable/beta) into settings, check, deploy, and version tracking

- Settings page now loads current values from DB and saves via save-option API
- check-novacpx-update reads update_channel setting, checks origin/main or origin/beta
- apply-novacpx-update pulls from channel branch, fixes backup dir (/tmp), fixes SQLite migration syntax, records new version in novacpx_version table + settings.panel_version
- deploy-runner.sh reads update_channel from DB, pulls correct branch, records version after deploy
- webhook.php accepts pushes to both main and beta branches
- Updates page shows channel badge and latest remote version

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/deploy-runner.sh

@@ -19,12 +19,18 @@ while IFS='|' read -r REPO_PATH WEB_ROOT COMMIT; do
   [[ -z "$REPO_PATH" ]] && continue
   log "--- Deploying commit $COMMIT ---"
 
+  # Read update channel from DB to know which branch to pull
+  DB_PATH=$(python3 -c "import configparser; c=configparser.ConfigParser(); c.read('/etc/novacpx/config.ini'); print(c.get('database','path',fallback='/var/lib/novacpx/panel.db'))" 2>/dev/null || echo "/var/lib/novacpx/panel.db")
+  CHANNEL=$(sqlite3 "$DB_PATH" "SELECT value FROM settings WHERE key='update_channel'" 2>/dev/null || echo "stable")
+  TARGET_BRANCH="main"
+  [[ "$CHANNEL" == "beta" ]] && TARGET_BRANCH="beta"
+
   # Validate PHP syntax before applying
   cd "$REPO_PATH" || continue
   git fetch origin >> "$LOG" 2>&1
 
   # Check PHP syntax on changed .php files
-  CHANGED_PHP=$(git diff HEAD..origin/main --name-only 2>/dev/null | grep '\.php$' || true)
+  CHANGED_PHP=$(git diff HEAD..origin/${TARGET_BRANCH} --name-only 2>/dev/null | grep '\.php$' || true)
   SYNTAX_OK=true
   for f in $CHANGED_PHP; do
     [[ -f "$REPO_PATH/$f" ]] || continue
@@ -40,9 +46,9 @@ while IFS='|' read -r REPO_PATH WEB_ROOT COMMIT; do
     continue
   fi
 
-  # Pull
+  # Pull from channel branch
   BEFORE=$(git rev-parse HEAD)
-  git pull origin main >> "$LOG" 2>&1
+  git pull origin "${TARGET_BRANCH}" >> "$LOG" 2>&1
   AFTER=$(git rev-parse HEAD)
 
   if [[ "$BEFORE" == "$AFTER" ]]; then
@@ -69,7 +75,6 @@ while IFS='|' read -r REPO_PATH WEB_ROOT COMMIT; do
 
   # Run pending DB migrations (SQLite)
   MIGR_DIR="$REPO_PATH/db/migrations"
-  DB_PATH=$(python3 -c "import configparser; c=configparser.ConfigParser(); c.read('/etc/novacpx/config.ini'); print(c.get('database','path',fallback='/var/lib/novacpx/panel.db'))" 2>/dev/null || echo "/var/lib/novacpx/panel.db")
   if [[ -d "$MIGR_DIR" && -f "$DB_PATH" ]]; then
     for SQL in "$MIGR_DIR"/*.sql; do
       [[ -f "$SQL" ]] || continue
@@ -83,6 +88,14 @@ while IFS='|' read -r REPO_PATH WEB_ROOT COMMIT; do
     done
   fi
 
+  # Record new version in DB
+  NEW_VERSION=$(cat "$REPO_PATH/VERSION" 2>/dev/null | tr -d '[:space:]' || true)
+  if [[ -n "$NEW_VERSION" && -f "$DB_PATH" ]]; then
+    sqlite3 "$DB_PATH" "INSERT INTO novacpx_version (version, installed_at, notes, commit_hash) VALUES ('$NEW_VERSION', datetime('now'), 'Auto-deployed via webhook ($CHANNEL channel)', '$AFTER')" 2>/dev/null || true
+    sqlite3 "$DB_PATH" "INSERT INTO settings (key, value, updated_at) VALUES ('panel_version', '$NEW_VERSION', datetime('now')) ON CONFLICT(key) DO UPDATE SET value=excluded.value, updated_at=excluded.updated_at" 2>/dev/null || true
+    log "Version updated to $NEW_VERSION"
+  fi
+
   # Ensure deploy webhook is accessible from web root
   mkdir -p "$WEB_ROOT/deploy"
   ln -sf "$REPO_PATH/deploy/webhook.php" "$WEB_ROOT/deploy/webhook.php"

deploy/webhook.php

@@ -37,8 +37,10 @@ if ($secret) {
 $payload = json_decode($rawBody, true);
 $pushedBranch = basename($payload['ref'] ?? '');
 
-if ($pushedBranch !== $branch) {
-    echo json_encode(['status' => 'skipped', 'reason' => "Not target branch ($branch)"]);
+// Accept pushes to main (stable) or beta — both can trigger deploys
+$allowedBranches = ['main', 'beta'];
+if (!in_array($pushedBranch, $allowedBranches)) {
+    echo json_encode(['status' => 'skipped', 'reason' => "Not a deployable branch ($pushedBranch)"]);
     exit;
 }
 
@@ -46,9 +48,9 @@ $commit  = $payload['after'] ?? 'unknown';
 $pusher  = $payload['pusher']['name'] ?? 'unknown';
 $message = $payload['head_commit']['message'] ?? '';
 
-log_deploy("Deploy triggered by $pusher | commit $commit | $message");
+log_deploy("Deploy triggered by $pusher | branch $pushedBranch | commit $commit | $message");
 
-// Queue the deploy (non-blocking)
+// Queue the deploy — include branch so runner knows what to pull
 $queueFile = '/tmp/novacpx-deploy-queue.txt';
 file_put_contents($queueFile, "$repoPath|$webRoot|$commit\n", FILE_APPEND | LOCK_EX);