v0.1.1: GUI auto-elevates, installer handles upgrades cleanly (#2)

* v0.1.1: GUI auto-elevates, installer stops service before file copy

Two fixes for the v0.1.0 install experience:

1. Embed app.manifest with requestedExecutionLevel=requireAdministrator
   so the GUI always elevates. The named pipe is ACL'd to SYSTEM and
   the Administrators group, but UAC token splitting puts Admins in
   deny-only on the standard token, so launching the GUI from the
   Start Menu fails to connect with "Access is denied". The manifest
   forces UAC to elevate, surfaces the shield icon on the shortcut,
   and matches the reality that the GUI cannot function without
   admin rights.

2. Add a [Code] PrepareToInstall hook to webhook-server.iss that runs
   `sc stop WebhookServer` before file copy. Upgrade installs were
   failing on locked binaries because the running service held the
   exes open. sc returns non-zero on fresh installs (no service yet)
   which we ignore.

Bumps Version to 0.1.1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Rename "Backups" menu item to "Config Checkpoints"

User-facing copy only; internal API names (Backups collection,
BackupEntry, list-backups op, etc.) stay the same to avoid churn
through the wire protocol and existing on-disk files. The new
phrasing makes the auto-snapshot-before-save model more discoverable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Installer: synchronous service stop + kill stray GUI/Service processes

The previous sc.exe stop is fire-and-forget; on slower machines the
file-copy step started before the service had actually released its
binaries, leaving the upgrade in a broken state. Switch to net.exe
stop which blocks until the service reports STOPPED.

Also taskkill any running WebhookServer.Gui.exe (the user might have
left the tray running) and any orphan WebhookServer.Service.exe (from
deploy.ps1 dev runs) so all copies of the binaries are unlocked
before [Files] runs.

Pre-flight ServiceExists() check via sc query so the installer only
calls "net stop" when there is actually a service to stop, rather
than relying on net's error code.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/WebhookServer.Gui/ViewModels/MainViewModel.cs

@@ -189,7 +189,7 @@ public sealed partial class MainViewModel : ObservableObject
                 foreach (var b in list) Backups.Add(b);
             });
         }
-        catch { /* ignore - backup listing isn't critical */ }
+        catch { /* ignore - checkpoint listing isn't critical */ }
     }
 
     [RelayCommand]
@@ -197,8 +197,8 @@ public sealed partial class MainViewModel : ObservableObject
     {
         if (entry is null) return;
         var ok = MessageBox.Show(
-            $"Restore configuration from {entry.FileName} ({entry.SavedAt:yyyy-MM-dd HH:mm})?\n\nA backup of the current config will be saved first.",
-            "Restore backup",
+            $"Restore the configuration from the checkpoint taken at {entry.SavedAt:yyyy-MM-dd HH:mm}?\n\nThe current configuration is automatically saved as a new checkpoint first, so you can roll forward again.",
+            "Restore checkpoint",
             MessageBoxButton.OKCancel,
             MessageBoxImage.Question);
         if (ok != MessageBoxResult.OK) return;
@@ -249,7 +249,7 @@ public sealed partial class MainViewModel : ObservableObject
             if (cfg is null) throw new InvalidOperationException("File did not contain a valid config.");
 
             var ok = MessageBox.Show(
-                $"Replace the current configuration with {dlg.FileName}?\n\nA backup of the current config will be saved first.",
+                $"Replace the current configuration with {dlg.FileName}?\n\nA checkpoint of the current config is saved first, so you can roll back from File → Config Checkpoints.",
                 "Import config",
                 MessageBoxButton.OKCancel,
                 MessageBoxImage.Warning);