fix(upgrade): use uv tool upgrade for launcher (pip-less) installs

[lstein]

Problem

Clicking Update in the About dialog returns a 500 on POST /version/update for launcher installs, with:

{"success": false, "message": "Update failed",
 "error": ".../uv/tools/photomapai/bin/python3: No module named pip\n"}

The endpoint hardcoded python -m pip install --upgrade photomapai, but the desktop launcher installs via uv tool install (launcher/uv.go), which produces a deliberately pip-less environment. So inline upgrade was broken for every launcher install — the primary distribution path. It only worked in pip-based installs (dev .venv, legacy installer scripts).

The X-Requested-With 403 some may hit is unrelated — that's the CSRF guard firing only from Swagger's "Try it out" (which omits the header); the real about.js sends it.

Fix

Choose the upgrade command by install type, branching on whether pip actually imports (the exact failure condition) rather than sniffing install paths:

• pip importable → python -m pip install --upgrade photomapai (unchanged)
• pip absent → locate uv (PATH, then the ~/.local/bin location uv self-installs to) → uv tool upgrade photomapai
• pip absent and no uv → 500 with actionable guidance ("re-run the launcher with --reinstall") instead of the cryptic pip error

Restart is unchanged — the supervisor (photomap_server.py:167) already respawns the worker after an upgrade, so new code loads.

Tests

New tests/backend/test_upgrade.py (9 tests): command selection for both install types, the unavailable case, the X-Requested-With guard, and the subprocess-failure / timeout paths. ruff clean.

Release / "breaking change" note

The uv launcher first shipped in v1.0.6rc1 and has never been in a stable release. Landing this in 1.1.0 (first stable with the launcher) means no public breaking change:

Population	Install	Inline upgrade
Stable ≤1.0.5	pip	works → pulls 1.1.0
New 1.1.0	uv launcher	works (uv path)
v1.0.6rc1 testers (only stranded group)	uv launcher	one-time: re-run launcher with --reinstall

The already-running rc1 code can't be fixed remotely (the pip command is baked in), but that group is small/known and the re-run-launcher recovery needs no uv knowledge. Worth a one-line mention in the 1.1.0 release notes.

🤖 Generated with Claude Code