Phase 0: remove auto-updater, pin Go 1.27.1, fix vet warnings, tidy ignores

- Delete BinaryUpdate, internal/up2date, GitHub/Update structs and the
  xteveAutoUpdate / update.url settings (UI rows, en.json, defaults).
  Settings-schema migrations kept and moved to src/migrate.go.
- Drop kardianos/osext dependency.
- xteve.go version 0200 -> 0201 to match changelog; Drone now fails on drift.
- go.mod go 1.27.1; Dockerfile and Drone golang images pinned to 1.27.1.
- Fix four go vet unreachable-code warnings.
- .gitignore: .gocache/, agent.md, skill.md. .dockerignore: build context
  no longer includes caches, ts/, tasks/ or markdown except the changelog.
- Drone: publish :latest only from master; other branches publish a
  branch-named tag so a feature push cannot replace the deployed image.
- Add tasks/improvement-plan.md and tasks/todo.md.
- Regenerate src/webUI.go.

ts/settings_ts.ts

@@ -287,20 +287,6 @@ class SettingsCategory {
         setting.appendChild(tdRight)
         break
 
-      case "xteveAutoUpdate":
-        var tdLeft = document.createElement("TD")
-        tdLeft.innerHTML = "{{.settings.xteveAutoUpdate.title}}" + ":"
-
-        var tdRight = document.createElement("TD")
-        var input = content.createCheckbox(settingsKey)
-        input.checked = data
-        input.setAttribute("onchange", "javascript: this.className = 'changed'")
-        tdRight.appendChild(input)
-
-        setting.appendChild(tdLeft)
-        setting.appendChild(tdRight)
-        break
-
       case "api":
         var tdLeft = document.createElement("TD")
         tdLeft.innerHTML = "{{.settings.api.title}}" + ":"
@@ -481,10 +467,6 @@ class SettingsCategory {
         }
         break
 
-      case "xteveAutoUpdate":
-        text = "{{.settings.xteveAutoUpdate.description}}"
-        break
-
       case "backup.keep":
         text = "{{.settings.backupKeep.description}}"
         break