Adds an update window that stays closed while threads run or wait for input,
for 15 minutes after any client interaction, and while a scheduled task or
usage-limit resume is due within 10 minutes. A new Update automatically
setting (on by default) installs provider CLI updates inside that window.

The provider maintenance runner is now one server-lifetime instance, so RPC
and background updates share the per-installer lock. It was previously built
per WebSocket connection, so two clients' updates never queued.