Wire update channel (stable/beta) into settings, check, deploy, and version tracking

- Settings page now loads current values from DB and saves via save-option API
- check-novacpx-update reads update_channel setting, checks origin/main or origin/beta
- apply-novacpx-update pulls from channel branch, fixes backup dir (/tmp), fixes SQLite migration syntax, records new version in novacpx_version table + settings.panel_version
- deploy-runner.sh reads update_channel from DB, pulls correct branch, records version after deploy
- webhook.php accepts pushes to both main and beta branches
- Updates page shows channel badge and latest remote version

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/webhook.php

@@ -37,8 +37,10 @@ if ($secret) {
 $payload = json_decode($rawBody, true);
 $pushedBranch = basename($payload['ref'] ?? '');
 
-if ($pushedBranch !== $branch) {
-    echo json_encode(['status' => 'skipped', 'reason' => "Not target branch ($branch)"]);
+// Accept pushes to main (stable) or beta — both can trigger deploys
+$allowedBranches = ['main', 'beta'];
+if (!in_array($pushedBranch, $allowedBranches)) {
+    echo json_encode(['status' => 'skipped', 'reason' => "Not a deployable branch ($pushedBranch)"]);
     exit;
 }
 
@@ -46,9 +48,9 @@ $commit  = $payload['after'] ?? 'unknown';
 $pusher  = $payload['pusher']['name'] ?? 'unknown';
 $message = $payload['head_commit']['message'] ?? '';
 
-log_deploy("Deploy triggered by $pusher | commit $commit | $message");
+log_deploy("Deploy triggered by $pusher | branch $pushedBranch | commit $commit | $message");
 
-// Queue the deploy (non-blocking)
+// Queue the deploy — include branch so runner knows what to pull
 $queueFile = '/tmp/novacpx-deploy-queue.txt';
 file_put_contents($queueFile, "$repoPath|$webRoot|$commit\n", FILE_APPEND | LOCK_EX);