fix: apply_update concurrency lock, boot.js settings-fail guard, dead workspace code, test_updates URL param

- api/updates.py: add _apply_lock to prevent concurrent stash/pull/pop
- static/boot.js: set check_for_updates:false on settings fetch failure
- static/panels.js: remove dead settingsWorkspace references (element removed from HTML)
- api/routes.py + static/boot.js: add ?test_updates=1 URL param for testing banner
  without being behind on git (localhost-only simulate endpoint)

api/routes.py

@@ -231,7 +231,15 @@ def handle_get(handler, parsed) -> bool:
         settings = load_settings()
         if not settings.get('check_for_updates', True):
             return j(handler, {'disabled': True})
-        force = parse_qs(parsed.query).get('force', ['0'])[0] == '1'
+        qs = parse_qs(parsed.query)
+        force = qs.get('force', ['0'])[0] == '1'
+        # ?simulate=1 returns fake behind counts for UI testing (localhost only)
+        if qs.get('simulate', ['0'])[0] == '1' and handler.client_address[0] == '127.0.0.1':
+            return j(handler, {
+                'webui': {'name': 'webui', 'behind': 3, 'current_sha': 'abc1234', 'latest_sha': 'def5678', 'branch': 'master'},
+                'agent': {'name': 'agent', 'behind': 1, 'current_sha': 'aaa0001', 'latest_sha': 'bbb0002', 'branch': 'master'},
+                'checked_at': 0,
+            })
         from api.updates import check_for_updates
         return j(handler, check_for_updates(force=force))