feat(selfhost): start full updates from administration

scripts/selfhost-update.py

@@ -418,7 +418,14 @@ class Updater:
         for name in required:
             if old[name].get("profiles") or new[name].get("profiles") or new[name].get("build"):
                 raise UpdateError("Build-Kontexte und Compose-Profile werden nicht unterstützt.")
-            if old[name].get("volumes", []) != new[name].get("volumes", []):
+            old_mounts, new_mounts = old[name].get("volumes", []), new[name].get("volumes", [])
+            # One-time bootstrap of the constrained updater API; never relax data-mount checks.
+            control_mount = {"type": "bind", "source": "/run/fedeo-updater", "target": "/run/fedeo-updater",
+                             "read_only": True, "bind": {}}
+            control_variants = (control_mount, {**control_mount, "bind": {"create_host_path": True}})
+            if name == "backend" and not any(v.get("target") == "/run/fedeo-updater" for v in old_mounts):
+                new_mounts = [v for v in new_mounts if v not in control_variants]
+            if old_mounts != new_mounts:
                 raise UpdateError(f"Datenpfade/Mounts von {name} würden verändert; zuerst manuell migrieren.")
             if old[name].get("container_name") != new[name].get("container_name"):
                 raise UpdateError(f"Container-Identität von {name} würde verändert.")