feat: Add AI-driven auto-update & restructure into package

The monolithic check_updates.py has been split into the update_monitor/
package with separate modules for fetching, extraction, comparison,
classification, and notification. This makes the codebase easier to
navigate and test.

The flat services.yaml is replaced by per-service directories under
services/<name>/config.yaml, co-locating config with update scripts
and AI review examples.

When --auto-update is enabled, services with an auto-update.sh script
get their release notes classified by a local Ollama model (using
few-shot examples from review-examples/) to decide whether the update
can be applied automatically or needs manual admin intervention. Results
are reported in a single consolidated Matrix message.

Immich is the first service with auto-update configured, using 7
real release note examples to train the classifier.

update_monitor/notifier.py

@@ -0,0 +1,55 @@
+import json
+import os
+import sys
+import time
+from urllib.parse import quote
+
+from .fetcher import fetch_response
+
+
+def send_matrix_message(message: str, timeout: float) -> None:
+    homeserver = os.getenv("MATRIX_HOMESERVER")
+    room_id = os.getenv("MATRIX_ROOM_ID")
+    token = os.getenv("MATRIX_ACCESS_TOKEN")
+    if not homeserver or not room_id or not token:
+        return
+    _join_matrix_room(homeserver, room_id, token, timeout)
+    txn_id = str(int(time.time() * 1000))
+    url = f"{homeserver}/_matrix/client/v3/rooms/{room_id}/send/m.room.message/{txn_id}"
+    payload = json.dumps({"msgtype": "m.text", "body": message}).encode("utf-8")
+    try:
+        fetch_response(
+            url,
+            timeout=timeout,
+            user_agent="service-update-alerts",
+            extra_headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
+            data=payload,
+            method="PUT",
+        )
+    except Exception as exc:
+        print(f"Matrix notification failed: {exc}", file=sys.stderr)
+
+
+def _join_matrix_room(homeserver: str, room_id: str, token: str, timeout: float) -> None:
+    url = f"{homeserver}/_matrix/client/v3/join/{quote(room_id, safe='')}"
+    try:
+        fetch_response(
+            url,
+            timeout=timeout,
+            user_agent="service-update-alerts",
+            extra_headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
+            data=b"{}",
+            method="POST",
+        )
+    except Exception:
+        return
+
+
+def send_uptime_kuma_ping(timeout: float) -> None:
+    push_url = os.getenv("UPTIME_KUMA_PUSH_URL")
+    if not push_url:
+        return
+    try:
+        fetch_response(push_url, timeout=timeout, user_agent="service-update-alerts")
+    except Exception as exc:
+        print(f"Uptime Kuma push failed: {exc}", file=sys.stderr)