Fix release asset deployment

Package built frontend assets in wheels and force clean upgrades.

Run API-triggered updates in a transient unit with a safe delay.

tests/test_deploy_scripts.py

@@ -1,6 +1,8 @@
 import fcntl
 import os
 import subprocess
+import sys
+import zipfile
 from pathlib import Path
 
 
@@ -30,3 +32,28 @@ def test_repo_upgrade_refuses_concurrent_run(tmp_path):
 
     assert result.returncode == 1
     assert "another Importarr upgrade is already running" in result.stderr
+
+
+def test_wheel_contains_built_frontend_assets(tmp_path):
+    root = Path(__file__).parents[1]
+    subprocess.run(
+        [sys.executable, "-m", "pip", "wheel", "--no-deps", "--wheel-dir", str(tmp_path), str(root)],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+    wheel = next(tmp_path.glob("importarr-*.whl"))
+    with zipfile.ZipFile(wheel) as archive:
+        packaged = set(archive.namelist())
+
+    assert "importarr/static/index.html" in packaged
+    assert "importarr/static/assets/app.js" in packaged
+    assert "importarr/static/assets/app.css" in packaged
+
+
+def test_repo_upgrade_forces_fresh_install_without_skipping_dependencies():
+    script = (Path(__file__).parents[1] / "deploy/repo-upgrade.sh").read_text()
+
+    assert "pip\" install --upgrade --force-reinstall --no-cache-dir" in script
+    assert "--no-deps" not in script

tests/test_status.py

@@ -194,6 +194,32 @@ def test_update_schedules_exact_latest_release_tag(tmp_path, monkeypatch):
     assert response["status"] == "update_scheduled"
 
 
+def test_update_is_scheduled_outside_service_cgroup(tmp_path, monkeypatch):
+    monkeypatch.setenv("IMPORTARR_STATE_PATH", str(tmp_path / "state.db"))
+    import importarr.main as main
+
+    calls = []
+
+    def fake_run(command, **kwargs):
+        calls.append((command, kwargs))
+        return main.subprocess.CompletedProcess(command, 0, stdout="Running as unit", stderr="")
+
+    monkeypatch.setattr(main.subprocess, "run", fake_run)
+    main._schedule_update(["/bin/sh", "/opt/importarr/repo-upgrade.sh", "v1.2.3"])
+
+    assert calls[0][0] == [
+        "systemd-run",
+        "--unit=importarr-update",
+        "--collect",
+        "--no-block",
+        "--on-active=2s",
+        "--",
+        "/bin/sh",
+        "/opt/importarr/repo-upgrade.sh",
+        "v1.2.3",
+    ]
+
+
 def test_update_endpoint_requires_expected_tag(tmp_path, monkeypatch):
     monkeypatch.setenv("IMPORTARR_STATE_PATH", str(tmp_path / "state.db"))
     import importarr.main as main