feat: show Ubuntu phased updates apart and leave them out of pending counts

apt lists phased updates as upgradable while an upgrade defers them until
Ubuntu selects the host, so a freshly patched server kept reporting pending
updates. The agent now flags them; the server stores the flag and leaves them
out of patch run counts, and the server page shows them in their own section.

server/internal/mcp/tools_work.go

@@ -80,6 +80,8 @@ type pendingUpdate struct {
 	Package        string `json:"package"`
 	CurrentVersion string `json:"current_version,omitempty"`
 	NewVersion     string `json:"new_version"`
+	// Phased is an Ubuntu phased update apt defers until the host is selected.
+	Phased bool `json:"phased,omitempty"`
 }
 
 type listPendingUpdatesResult struct {
@@ -390,7 +392,7 @@ func init() {
 					}
 					out = append(out, pendingUpdate{
 						ServerID: srv.ServerID, Hostname: srv.Hostname,
-						Package: u.Name, CurrentVersion: u.CurrentVersion, NewVersion: u.NewVersion,
+						Package: u.Name, CurrentVersion: u.CurrentVersion, NewVersion: u.NewVersion, Phased: u.Phased,
 					})
 				}
 				return listPendingUpdatesResult{Updates: out, Shown: len(out)}, nil
@@ -411,7 +413,7 @@ func init() {
 					}
 					out = append(out, pendingUpdate{
 						ServerID: srv.ServerID, Hostname: srv.Hostname,
-						Package: u.Name, CurrentVersion: u.CurrentVersion, NewVersion: u.NewVersion,
+						Package: u.Name, CurrentVersion: u.CurrentVersion, NewVersion: u.NewVersion, Phased: u.Phased,
 					})
 				}
 			}