fix(update): concurrent apply reads as progress, not failure; idle-IO extraction

"Another update operation is already running" surfaced as a scary
failure while the update was in fact applying fine (OptiPlex, v1.7.118
rollout). The apply path now joins the in-flight install — same
overlay, same wait-for-new-version polling — and a concurrent download
attempt shows a calm in-progress note (EN+ES strings added). The
backend's tarball extractions run under ionice -c3 nice -n10 so a
200MB update can't starve podman/status calls into multi-minute
timeouts on small disks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/update.rs

@@ -1589,10 +1589,24 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
                 if !mk.success() {
                     anyhow::bail!("mkdir {} failed", staging_new);
                 }
-                let extract =
-                    host_sudo(&["tar", "-xzf", &src.to_string_lossy(), "-C", &staging_new])
-                        .await
-                        .with_context(|| format!("Failed to extract {}", name))?;
+                // Idle-priority IO: extracting a 200MB tarball at normal
+                // priority starved small nodes so badly during the v1.7.118
+                // rollout that podman/status calls timed out for minutes and
+                // the update looked broken. The extraction can take as long
+                // as it likes — the node staying responsive matters more.
+                let extract = host_sudo(&[
+                    "ionice",
+                    "-c3",
+                    "nice",
+                    "-n10",
+                    "tar",
+                    "-xzf",
+                    &src.to_string_lossy(),
+                    "-C",
+                    &staging_new,
+                ])
+                .await
+                .with_context(|| format!("Failed to extract {}", name))?;
                 if !extract.success() {
                     let _ = host_sudo(&["rm", "-rf", &staging_new]).await;
                     anyhow::bail!("tar extraction failed for {}", name);
@@ -1687,9 +1701,12 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
                     anyhow::bail!("mkdir {} failed", staging_new);
                 }
 
-                let extract = host_sudo(&["tar", "-xzf", &archive, "-C", &staging_new])
-                    .await
-                    .with_context(|| format!("Failed to extract {}", name))?;
+                // Idle-priority IO — same reasoning as the frontend tarball.
+                let extract = host_sudo(&[
+                    "ionice", "-c3", "nice", "-n10", "tar", "-xzf", &archive, "-C", &staging_new,
+                ])
+                .await
+                .with_context(|| format!("Failed to extract {}", name))?;
                 if !extract.success() {
                     let _ = host_sudo(&["rm", "-rf", &staging_new]).await;
                     anyhow::bail!("tar extraction failed for {}", name);