feat: show Ubuntu phased updates apart and leave them out of pending counts

apt lists phased updates as upgradable while an upgrade defers them until
Ubuntu selects the host, so a freshly patched server kept reporting pending
updates. The agent now flags them; the server stores the flag and leaves them
out of patch run counts, and the server page shows them in their own section.

web/lib/api.ts

@@ -5,6 +5,13 @@ export interface PackageUpdate {
     name: string;
     current_version?: string;
     new_version: string;
+    /** Ubuntu phased update this host is not yet selected for: apt defers it. */
+    phased?: boolean;
+}
+
+/** Updates an upgrade would install now. Phased updates are pending but deferred by apt. */
+export function installableUpdates(updates: PackageUpdate[] | undefined): PackageUpdate[] {
+    return (updates ?? []).filter((u) => !u.phased);
 }
 
 export interface Inventory {