ADFA-5333 feat(dashboard): run the live update in the background - #493

The live REST dashboard update (dash-node >= 1.2.0) trapped the user behind a
non-cancelable modal that polled for up to ~6.5 min, then showed a "taking longer
than usual" timeout when a fixed cap expired. The rebuild already runs detached in
the box (blue-green, returns 202), so hold nothing on the client and don't guess
completion by a clock.

Hand off to a new DashboardRebuildService (foreground + notification): the user
navigates freely while it POSTs the rebuild and polls status. Completion is the
server's signal (done/error), not a time cap — MAX_POLLS and the k2go_dash_live_timeout
string are gone. State changes broadcast (running/done/error); a static isRunning()
lets a card opened mid-update pick it up.

In-app progress lives on the dashboard card, not only in the notification: while a
rebuild runs, an indeterminate Material bar shows above Rebuild (disabled meanwhile),
and the version chip/pill refresh in place on completion. The card re-derives state
from the box on open, so even after a process kill it shows progress and re-owns the
service (409 re-attach). The ongoing notification is not dismissible and does not
auto-cancel on tap; tapping it deep-links to Module management > Dashboard
(EXTRA_DASHBOARD_DETAIL, handled in onCreate and onNewIntent). On done/error it
becomes a dismissible result.

The proot bridge path (< 1.2.0) is unchanged; it stops the box and keeps its own
guarded screen. Strings localized across all 33 locales.

…, mutual exclusion

The live dash-node update (>= 1.2.0) trapped the user behind a non-cancelable modal
that polled a fixed ~6.5 min budget and then showed a "taking longer than usual"
timeout. The rebuild already runs detached in the box (blue-green, returns 202), so
this moves it to the background and makes it observable, cancelable, and safely
serialized against downloads.

Background + completion by signal
- New DashboardRebuildService (foreground + notification): the user navigates freely
  while it POSTs the rebuild and polls status. Completion is the server's signal
  (done/error) confirmable by the live version — no time cap. MAX_POLLS and
  k2go_dash_live_timeout are gone.

In-app progress, not only a notification
- The dashboard card shows an indeterminate Material bar (the rebuild has no percent)
  with a Cancel beside it; version chip/pill refresh in place on completion. The card
  re-derives state from the box on open, so even after a process kill it shows progress
  and re-owns the service (409 re-attach). The ongoing notification is non-dismissible,
  doesn't auto-cancel on tap, deep-links to Module management > Dashboard
  (EXTRA_DASHBOARD_DETAIL, handled in onCreate + onNewIntent), and carries a Cancel action.

Clean cancel (device + dash-node)
- Server: POST /system/dashboard/rebuild/cancel. rebuild-dashboard.sh records its phase
  (building/promoting) and session-leader pid; cancel while "building" signals the
  detached group (its EXIT/TERM trap purges staging), leaving the live dashboard as it
  was; refused while "promoting", and the script ignores INT/TERM through the swap so it
  is never interrupted mid-flight. dash-node 1.2.8 -> 1.2.9 (+ CHANGELOG).
- Device: DashboardClient.rebuildCancel + a Cancel action/button; on success the service
  stops and the card re-enables Rebuild; if too late or unreachable it says so and the
  update finishes.

Mutual exclusion (a live update and a live download share dash-node; the update restarts
it and would break an in-flight download)
- EnvironmentLock gains Holder.DASHBOARD, so deep-env ops (backup/restore/clone/install)
  defer to an in-flight update automatically; the three live-download starts (ZIM/Books/
  Kolibri), which don't consult the lock, get an explicit refusal (k2go_busy_dashboard).

The proot bridge path (< 1.2.0) is unchanged. New strings localized across all 33 locales.

Review follow-ups on the background dashboard update:

- Re-own can no longer start an unintended rebuild. DashboardRebuildService gains
  ACTION_ATTACH / attach(): the card re-owns an already-running rebuild by polling
  to completion, never POSTing /rebuild, so a rebuild that finishes in the gap
  between the status check and re-attach can't trigger a fresh run.

- The reverse gate now covers auto-drains, not just user taps. ZimProvisioner and
  BooksProvisioner drain() and KolibriProvisioner canDrainNow() defer while
  DashboardRebuildService.isRunning(), so a banked wishlist can't auto-start a live
  download mid-rebuild (which the dash-node restart would disrupt).

- Cancel is hardened on both ends. rebuild-dashboard.sh traps INT/TERM to on_cancel,
  which sets the status to idle before cleanup, so a canceled build never leaves a
  wedged "running" (promote stays signal-proof). The cancel endpoint verifies the
  recorded pid is actually rebuild-dashboard.sh (via