feat: add resilient updates and access controls

Dockerfile

@@ -1,5 +1,7 @@
 # syntax=docker/dockerfile:1.7
-FROM golang:1.25.12-alpine AS build
+FROM golang:1.25.13-alpine AS build
+
+ARG VERSION=v1.3.0
 
 RUN apk add --no-cache build-base
 WORKDIR /src
@@ -8,7 +10,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/dyndns-web ./cmd/dyndns-web
+RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -ldflags="-s -w -X github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo.Version=${VERSION}" -o /out/dyndns-web ./cmd/dyndns-web && \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/update-agent ./cmd/update-agent
 
 FROM alpine:3.23.2 AS runtime
 
@@ -18,6 +21,7 @@ RUN apk add --no-cache ca-certificates && \
     mkdir -p /data /secrets && chown dyndns:dyndns /data /secrets
 
 COPY --from=build /out/dyndns-web /usr/local/bin/dyndns-web
+COPY --from=build /out/update-agent /usr/local/bin/update-agent
 
 USER dyndns:dyndns
 WORKDIR /data