release(v1.7.4-alpha): fix Install Update tar extraction + progress overshoot

apply_update was extracting the frontend tarball with
`tar -xzf -C /opt/archipelago`, but the tar contents are the *inside*
of web-ui/ (root entries are ./test-aiui.html, ./assets/, etc.). So
the files landed directly in /opt/archipelago instead of under web-ui/,
and tar bailed on nginx-owned paths mid-extraction. First end-to-end
OTA test (.198) found it: "tar: ./assets/SystemUpdate-…js: Cannot
open: No such file or directory".

Now extracts into web-ui.new, chowns, then atomically swaps: move
existing web-ui → web-ui.bak, then web-ui.new → web-ui. Same pattern
as the manual sideload that's been working.

Frontend: SystemUpdate.vue fake download progress was capped at "<90"
with a Math.random()*15 increment — the last tick could push to
~104.99%. Capped at 95% with a smaller step so it stops at 95 and the
real RPC completion jumps it to 100.

Artefacts:
  archipelago                                      a14ad7e4…2a2be3  40361984
  archipelago-frontend-1.7.4-alpha.tar.gz          4fb79664…0172e9  76984615

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

neode-ui/src/views/SystemUpdate.vue

@@ -345,10 +345,12 @@ async function downloadUpdate() {
   downloadPercent.value = 0
   statusMessage.value = ''
 
-  // Simulate incremental progress while waiting for the RPC
+  // Simulate incremental progress while waiting for the RPC. Capped at
+  // 95% so the bar never shows >100% before the real completion jumps it
+  // to 100 — previously the random increment could overshoot.
   const progressInterval = setInterval(() => {
-    if (downloadPercent.value < 90) {
-      downloadPercent.value += Math.random() * 15
+    if (downloadPercent.value < 95) {
+      downloadPercent.value = Math.min(95, downloadPercent.value + Math.random() * 3)
     }
   }, 500)