docs(backlog): add PKG-4 — update-available indicator on /settings/about (#693)

Captures the follow-up surfaced reviewing /settings/about: the page shows
only the running binary version (ldflags), never a comparison against the
latest release, so there's no in-app 'you're behind' signal. P3/post-GA.
Notes the air-gap design fork (GitHub release check vs OS package manager).

Signed-off-by: Remylus Losius <remyluslosius@gonaibo.com>

Author: remyluslosius

BACKLOG.md

@@ -101,6 +101,7 @@
 | ID | Item | Priority | Status | Notes |
 |----|------|----------|--------|-------|
 | PKG-3 | Remediation broken on every packaged install — Kensa rollback store can't open under the hardened unit | **P1** | Open | **Symptom (prod rc.14):** boot WARN `kensa remediation wiring unavailable` with `error=kensa: compose remediation service: …`; scans work but every remediation/rollback returns `kensa: remediate path not wired` (`internal/kensa/executor.go:153`). **Root cause:** `packaging/common/openwatch.service` sets `ProtectSystem=strict` + `ReadWritePaths=/var/lib/openwatch /var/log/openwatch` but (a) sets **no `WorkingDirectory`** (systemd defaults it to read-only `/`) and (b) **never sets `OPENWATCH_KENSA_STORE_PATH`**. So `kensaStorePath()` (`cmd/openwatch/main.go:768`) falls back to `.kensa/remediation.db` -> `/.kensa/remediation.db`, and Kensa's `OpenSQLite` `MkdirAll` fails on the read-only root. Scans are unaffected because the scan path composes a store-less Kensa; only remediation needs the SQLite rollback-pre-state store (`pkgkensa.DefaultWithTransportFactory`, pure-Go `modernc.org/sqlite`). **Fix:** add to the unit `Environment=OPENWATCH_KENSA_STORE_PATH=/var/lib/openwatch/kensa/remediation.db` and `WorkingDirectory=/var/lib/openwatch` (both `serve` and any `worker` unit — `worker.go:209` wires identically). **Regression:** a release test asserting remediation wiring composes under the hardened unit so it can't silently break again. **Operator workaround (no new pkg):** `systemctl edit openwatch` -> `[Service]\nEnvironment=OPENWATCH_KENSA_STORE_PATH=/var/lib/openwatch/kensa/remediation.db` -> restart. Worth an rc.15 since it breaks all remediation on hardened packaged installs |
+| PKG-4 | "Update available" indicator on `/settings/about` | P3 | Planned | Today the About page (`frontend/src/pages/settings/StubbedPages.tsx` `AboutPage`) shows only the **running** binary version (`version.Version`, ldflags-injected; `GET /api/v1/version`) — it never compares against the latest available release, so operators get no in-app signal they are behind (e.g. running rc.14 while rc.16 is published). Add a "latest available" source + semver(-rc) comparison + a badge. **The design fork is the air-gap tradeoff:** a GitHub release check (`api.github.com/repos/Hanalyx/OpenWatch/releases/latest`) phones home, which conflicts with OpenWatch's no-phone-home/air-gap-friendly stance — so it must be **opt-in and off by default**. Air-gap-friendly alternative: query the OS package manager for a newer `openwatch` package (`dnf check-update` / `apt`), which works against a local mirror and aligns with the existing auto-upgrade path (see the `dnf/apt update` auto-migrate flow). Surface as a badge on About (and optionally the TopBar). Post-GA. |
 
 ---