feat: update controls in the admin, release token scope, build info in CI images [CI]

The versions page shows each node's update state with update buttons, API
tokens get a release scope that can only register releases (used by CI), and
the CI image and release builds now pass the tag, commit and build time.

backend/src/Monitor.Backend.Application/Auth/AuthService.cs

@@ -77,7 +77,7 @@ public sealed partial class AuthService
             await _store.TouchApiTokenAsync(token.Id, now, ct);
         }
 
-        ApiScope scope = token.Scope == "admin" ? ApiScope.Admin : ApiScope.Read;
+        ApiScope scope = token.Scope switch { "admin" => ApiScope.Admin, "release" => ApiScope.Release, _ => ApiScope.Read };
         return new Principal(PrincipalKind.Token, scope, null, token.Name, null, token.Id);
     }
 
@@ -135,9 +135,9 @@ public sealed partial class AuthService
             return ValidationError.Fail<CreatedApiToken>("name", "must be 1-64 characters");
         }
 
-        if (scope is not ("read" or "admin"))
+        if (scope is not ("read" or "admin" or "release"))
         {
-            return ValidationError.Fail<CreatedApiToken>("scope", "must be read or admin");
+            return ValidationError.Fail<CreatedApiToken>("scope", "must be read, admin or release");
         }
 
         string plaintext = TokenHash.NewToken("mon");