fix(update): discard local package-lock.json before git pull, bump v0.4.9

npm install modifies package-lock.json on the server, causing
'git pull --ff-only' to abort with 'your local changes would be
overwritten'. Add 'git checkout -- package-lock.json' before the pull
so the generated lock file never blocks updates.

scripts/update.sh

@@ -14,6 +14,8 @@ INSTALL_DIR="${1:-/opt/nixpanel}"
 [[ -d "$INSTALL_DIR/.git" ]] || error "NixPanel not found at $INSTALL_DIR"
 
 step "Pulling latest code"
+# Discard any local changes to generated/lock files so git pull never conflicts
+git -C "$INSTALL_DIR" checkout -- package-lock.json 2>/dev/null || true
 git -C "$INSTALL_DIR" pull --ff-only
 success "Code updated"