fix: detach update process via systemd-run (v0.3.1)

- Changed backend/update.py to use systemd-run for spawning update/rollback scripts
- Ensures update process survives service restart
- Bumped version to 0.3.1

CHANGELOG.md

@@ -88,6 +88,8 @@ By: Codex (GPT-5)
 | 15.01.2026 | ⚙️ Code | ID: Makefile restart-Target hinzugefuegt. By: Codex (GPT-5) |
 | 16.01.2026 | ✨ Feat | ID: EPIC_000014/US_000045 Login-Regeln und Scheduler implementiert (UI + Backend). By: Gemini CLI |
 | 16.01.2026 | 🚀 Release | ID: VERSION auf 0.3.0 erhoeht. By: Gemini CLI |
+| 16.01.2026 | 🐞 Fix | ID: Update-Prozess via systemd-run entkoppelt, damit Service-Stop den Updater nicht killt. By: Gemini CLI |
+| 16.01.2026 | 🚀 Release | ID: VERSION auf 0.3.1 erhoeht. By: Gemini CLI |
 
 ---
 ## Legende

VERSION

@@ -1 +1 @@
-0.3.0
+0.3.1

backend/update.py

@@ -187,8 +187,23 @@ def _run_async(script_path: Path, settings: Settings) -> None:
     env["SKD_UPDATE_TOKEN"] = settings.update_token
     env["SKD_UPDATE_STATUS_FILE"] = settings.update_status_file
     env["SKD_UPDATE_LOG_FILE"] = settings.update_log_file
+
+    # Use systemd-run to detach the update process from the current service unit.
+    # This ensures the script survives 'systemctl stop skd'.
+    # We use --unit to give it a predictable name prefix (though unique suffix is added)
+    # and --scope (or --service) to create a new unit.
+    # Since we need root (and likely run as root), this should work.
+    # Note: --collect ensures garbage collection of the transient unit.
+    cmd = [
+        "systemd-run",
+        "--unit=skd-update",
+        "--collect",
+        "--description=Safe Kiddo Update Process",
+        str(script_path),
+    ]
+
     subprocess.Popen(
-        [str(script_path)],
+        cmd,
         env=env,
         cwd="/",
         stdout=subprocess.DEVNULL,

project-management/PROJECT_STATUS.md

@@ -1,4 +1,4 @@
-ID: STATUS_000001 | Version: 0.3.0 | Status: Final
+ID: STATUS_000001 | Version: 0.3.1 | Status: Final
 By: Codex (GPT-5)
 
 # Projekt-Status
@@ -24,6 +24,7 @@ Sicheres, remote steuerbares System zum Sperren/Entsperren lokaler Nutzerkonten.
 | 15.01.2026 | 📝 Req | Makefile als Einstieg in Doku aufgenommen. |
 | 15.01.2026 | ⚙️ Code | Makefile restart-Target hinzugefuegt. |
 | 16.01.2026 | ✨ Feat | Login-Zeitfenster (Rules & Scheduler) implementiert (US_000045). |
+| 16.01.2026 | 🐞 Fix | Update-Prozess entkoppelt (systemd-run), damit er beim Service-Stop weiterlaeuft. |
 
 ## Epic-Backlog (Uebersicht)
 ### EPIC_000001: Legacy CLI Account Control (sk.sh)