feat: add notification for admins when they are not on latest nao version

[ClaireGz]

Closes #569

Summary

• Adds a backend endpoint (system.checkUpdate) that fetches the latest nao release from GitHub and compares it with the current APP_VERSION
• Shows a small amber warning notification at the bottom of the left sidebar when the deployed version is outdated — links to the release page
• Admin-only: non-admin users don't see the notification and can't call the endpoint
• Works for both CLI (APP_VERSION=dev by default) and Docker deployments (version set via build arg)
• Backend caches the GitHub check for 1 hour to avoid rate limiting

Changed files

• apps/backend/src/services/version-check.service.ts — new service: fetches latest GitHub release, semver comparison with rc support, 1-hour in-memory cache
• apps/backend/src/trpc/system.routes.ts — new checkUpdate admin-protected route
• apps/frontend/src/components/sidebar-version-notice.tsx — new component: amber warning with tooltip when collapsed
• apps/frontend/src/components/sidebar.tsx — wires the notice into the sidebar bottom section (admin-only)

Notes

The original issue also mentioned showing release notes in the admin panel — this PR ships the floating notification only. Release notes in settings can be a follow-up if useful.

Test plan

• Deploy with an older APP_VERSION and verify the notification appears for admin users
• Verify the notification does NOT appear for non-admin users
• Verify the notification links to the correct GitHub release page
• Verify the collapsed sidebar shows a tooltip on hover
• Test with APP_VERSION=dev (default local development) — should show the notice
• Test with the latest version — notification should not appear
• Verify no GitHub API errors when offline (graceful failure, no notification shown)

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 4 files

[github-actions]

🚀 Preview Deployment

URL	https://pr-719-6e7e211.preview.getnao.io
Commit	6e7e211

⚠️ No LLM API keys configured - you'll see the API key setup flow when trying to chat.

---

_{Preview will be automatically removed when this PR is closed.}