Device update check

The entire client contract. `200` returns an update manifest, `204` means up to date or not in the current rollout cohort. Every check doubles as the heartbeat behind the fleet dashboard. Optional repeated query parameters `l.<key>=<value>` attach release-targeting labels to the check (e.g. `?l.region=eu`); they merge over labels stored by the push-mode fleet API and are persisted on the device. If the device's current version was rolled back, the manifest points at the newest published release below it with `allowDowngrade: true`. This endpoint **is** Tauri's dynamic-updater contract.

curl -X GET "https://example.com/u/string/string/string/string/string"

{  "version": "string",  "notes": "string",  "pub_date": "2019-08-24T14:15:22Z",  "url": "http://example.com",  "sha512": "string",  "signature": "string",  "size": 0,  "updateMode": "optional",  "minimumSupportedVersion": "string",  "allowDowngrade": true}

{  "error": "Unknown app"}

{  "error": "Rate limit exceeded"}