feat(updater): disable the in-app updater in containerized installs

The Docker image already injects CONTAINERIZED=true; consume it via config('invoiceshelf.containerized'), expose it on /app/version, block the update endpoints + console command, and show a 'docker compose pull' panel instead of the updater. Adds missing i18n keys.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/Http/Middleware/EnsureNotContainerized.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Blocks the in-app updater when running inside the official Docker image.
+ *
+ * Containers are upgraded with `docker compose pull`, not by copying release
+ * files over the image filesystem (which is ephemeral and reset on recreate).
+ * The CONTAINERIZED flag is injected into .env by docker/production/inject.sh.
+ */
+class EnsureNotContainerized
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        abort_if(
+            (bool) config('invoiceshelf.containerized'),
+            403,
+            'The in-app updater is disabled in containerized installs. Upgrade with `docker compose pull`.'
+        );
+
+        return $next($request);
+    }
+}