fix: review fixes for webhook and auto mode (#8)

Clear available_* only when the deployed ref equals it, drop the unused
poll source, stop leaking internal errors to CI, use the request-scoped
logger, validate X-Request-ID, re-read jobs once after the timeout,
report refused when no target ref exists, and tidy UI, deploy and docs.

README.md

@@ -18,9 +18,9 @@ runs is exactly what was pulled. The log streams to the browser while it runs; j
 history is kept in Postgres. A service without a tag (`repo@digest`), a plain container,
 and the updater's own services cannot be updated, and the UI says why. A bare image
 (`image: postgres`, no tag and no digest) counts as `postgres:latest`; only a reference
-with a digest and no tag (`repo@sha256:...`) "follows no tag". Compose services with a `build:` section are shown but never updated
-("built from source (build:)"). One update at a
-time per service, and one job at a time per agent.
+with a digest and no tag (`repo@sha256:...`) "follows no tag". Compose services with a
+`build:` section are shown but never updated ("built from source (build:)"). One update at
+a time per service, and one job at a time per agent.
 
 ## Deploying the master
 
@@ -54,7 +54,9 @@ Content-Type: application/json
 `image` is matched against the image repo of every service on every agent (tag and digest
 in the request are ignored for matching; matching is case-sensitive). `tag` is optional.
 For every match the master records the version as *available* (the overview shows an
-"update available" badge). Services in **manual** mode stop there. Services in **auto**
+"update available" badge), including services that cannot be updated automatically
+(updater's own, `build:` and plain containers), so the badge shows for them too. Services
+in **manual** mode stop there. Services in **auto**
 mode also get an update job, and the request waits for those jobs to finish, at most
 `UPDATE_TIMEOUT`.
 
@@ -63,7 +65,8 @@ from the service's own repo and never from the request's `image` string. The tag
 one that has been pushed. Compose services get pinned to it through
 `compose.override.yaml`, as in any update. Omit `tag` to re-pull the tag the service
 already follows (a bare image counts as `:latest`); a service that follows no tag
-(`repo@digest`) is then not touched, and an auto service is reported as `refused`.
+(`repo@digest`) is then not touched and is reported as `refused` ("no tag given and the
+service follows no tag"), manual or auto.
 With a `tag`, the "follows no tag" refusal does not apply; the other refusals (the
 updater's own services, `build:` services, plain containers) still do.
 
@@ -86,7 +89,7 @@ Response (`200` or `500`):
 | `timeout` | Job still running when `UPDATE_TIMEOUT` passed. The master leaves it running. | yes |
 | `marked` | Manual service; the version was recorded only. | no |
 | `busy` | The service already has a queued or running job; `job_id` is that job, which is not waited for. | no |
-| `refused` | The service may not be updated (`error` has the reason). | no |
+| `refused` | The service may not be updated, or there is no target (no `tag` given and the service follows no tag). `error` has the reason. | no |
 
 | Code | When |
 |---|---|