Updates card: scan npm/cargo deps, surface security advisories, install compatible updates

frontend/electron/main.ts

@@ -139,10 +139,11 @@ function startBackend(): void {
 
 /**
  * Upper bound for one backend round-trip. Generous on purpose: a publish can
- * wait for each relay in turn (10s connect + 15s send each). A hung backend
- * still gets reaped instead of leaking promises forever.
+ * wait on relays and dependency updates run npm/cargo commands that can take
+ * minutes on cold caches. A hung backend still gets reaped instead of leaking
+ * promises forever.
  */
-const BACKEND_TIMEOUT_MS = 120_000;
+const BACKEND_TIMEOUT_MS = 300_000;
 
 async function backendRequest(method: string, params: Record<string, unknown>): Promise<unknown> {
   startBackend();
@@ -196,6 +197,8 @@ const RENDERER_METHODS: ReadonlySet<string> = new Set([
   'relay_set_enabled',
   'relay_test',
   'settings_update',
+  'update_check',
+  'update_apply',
   'backup_now',
   'set_vault_password',
   'unlock_vault',