feat: Add AI-driven auto-update & restructure into package

The monolithic check_updates.py has been split into the update_monitor/
package with separate modules for fetching, extraction, comparison,
classification, and notification. This makes the codebase easier to
navigate and test.

The flat services.yaml is replaced by per-service directories under
services/<name>/config.yaml, co-locating config with update scripts
and AI review examples.

When --auto-update is enabled, services with an auto-update.sh script
get their release notes classified by a local Ollama model (using
few-shot examples from review-examples/) to decide whether the update
can be applied automatically or needs manual admin intervention. Results
are reported in a single consolidated Matrix message.

Immich is the first service with auto-update configured, using 7
real release note examples to train the classifier.

update_monitor/updater.py

@@ -0,0 +1,22 @@
+import subprocess
+from pathlib import Path
+from typing import Any, Dict
+
+
+def run_update_script(script_path: Path, current: str, latest: str, timeout: float) -> Dict[str, Any]:
+    try:
+        proc = subprocess.run(
+            [str(script_path), current, latest],
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+        )
+        return {
+            "success": proc.returncode == 0,
+            "output": proc.stdout.strip(),
+            "error": proc.stderr.strip(),
+        }
+    except subprocess.TimeoutExpired:
+        return {"success": False, "output": "", "error": "Script timed out"}
+    except Exception as exc:
+        return {"success": False, "output": "", "error": str(exc)}