feat: update controls in the admin, release token scope, build info in CI images [CI]

The versions page shows each node's update state with update buttons, API
tokens get a release scope that can only register releases (used by CI), and
the CI image and release builds now pass the tag, commit and build time.

packaging/container/Agent.NativeBuild.Containerfile

@@ -1,17 +1,17 @@
 FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
 
 WORKDIR /src/backend
-# 构建信息：CI 通过 --build-arg 传入；不传就是空
-ARG MONITOR_TAG=
-ARG MONITOR_COMMIT=
-ARG MONITOR_BUILT_AT=
-ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
 COPY restore/backend/ ./
 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
 RUN dotnet restore agent/src/Monitor.Agent -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts \
     && dotnet restore fleet/tools/fleet-enroll -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
+# 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
+ARG MONITOR_TAG=
+ARG MONITOR_COMMIT=
+ARG MONITOR_BUILT_AT=
+ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
 RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \