feat: settings dialog for update config (gear entry)

A low-key "⚙ 配置" button at the right end of the flow-tab row opens a settings
dialog to edit update_source / update_user / update_pass, with a test-connection
button that distinguishes "reachable & up to date" from "cannot connect".

- settings_dialog.py: pure-UI QDialog; password mask + show; test runs off the
  UI thread via load_manifest and reports the result
- update_service: add load_manifest() (raises on failure, unlike check_for_update)
- main_window: gear button, _open_settings persists via save_config and re-runs
  the update check; _update_found connected once to avoid duplicate banners
- tests: +2 for load_manifest

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/services/update_service.py

@@ -119,6 +119,18 @@ def _load_local_manifest(update_source):
         return json.load(f)
 
 
+def load_manifest(update_source, update_user="", update_pass=""):
+    """Fetch and parse the manifest dict, RAISING on failure.
+
+    Unlike check_for_update (which swallows errors into None), this surfaces
+    reachability/auth/format errors — used by the settings "test connection"
+    button to distinguish "reachable & up to date" from "cannot connect".
+    """
+    if _is_http_source(update_source):
+        return _load_http_manifest(update_source, update_user, update_pass)
+    return _load_local_manifest(update_source)
+
+
 def check_for_update(
     update_source,
     current_version,