feat(web): OS image lifecycle from the web: status, stage, activate and roll back #187

Summary

Bring cryptosctl image status/stage/rollback/activate into the FleetOS Manager web. The node already exposes it (StageImage, ActivateImage, RollbackImage and GetImageStatus on the node); the manager never calls it.

Acceptance criteria

• The manager proxies the node RPCs with operator-level authorization (viewer read-only, operator and admin as the existing write paths).
• A node's OS image can be checked, staged, activated and rolled back from node detail, by an admin, with the same refusals the node gives (signature, one operation at a time).
• Tests at the manager API and in the web, through public APIs.

Tasks

• Manager RPC and node client call.
• Web surface on the UI kit.
• Docs.

Notes

Part of #24 (full cryptosctl parity in the FleetOS Manager web). Found by an audit on 2026-10-14 comparing every cryptosctl command with the manager's fleet RPCs: this operation is still CLI-only.