[client] Keep the updater silent until management decides the mode

The update manager started in download-only mode and every engine stop
reset it there again, kicking the update loop with the cached latest
version. On a managed peer this published a "New version available"
notification on each disconnect, session expiry or logout, and once more
in the window between daemon start and the first network map. Users under
enforced updates then installed the release by hand.

Replace the boolean with a three-state mode. The manager starts undecided
and publishes nothing, from the fetcher or from NotifyUI, until the network
map picks download-only or managed. A new connection lifecycle resets to
undecided; disconnects leave the last decision untouched. A missing
AutoUpdateSettings now means download-only instead of a no-op, and on
platforms without an installer SetVersion falls back to download-only so
they keep notifying.

client/internal/engine.go

@@ -455,10 +455,6 @@ func (e *Engine) stopLocked() {
 		e.sessionWatcher.Close()
 	}
 
-	if e.updateManager != nil {
-		e.updateManager.SetDownloadOnly()
-	}
-
 	log.Info("cleaning up status recorder states")
 	e.statusRecorder.ReplaceOfflinePeers([]peer.State{})
 	e.statusRecorder.UpdateDNSStates([]peer.NSGroupState{})
@@ -971,11 +967,7 @@ func (e *Engine) handleAutoUpdateVersion(autoUpdateSettings *mgmProto.AutoUpdate
 		return
 	}
 
-	if autoUpdateSettings == nil {
-		return
-	}
-
-	if autoUpdateSettings.Version == disableAutoUpdate {
+	if autoUpdateSettings == nil || autoUpdateSettings.Version == disableAutoUpdate {
 		log.Infof("auto-update is disabled")
 		e.updateManager.SetDownloadOnly()
 		return