justfile: add update target to automate version bumps; push ui to cachix

push-cache was only printing the main invoiceninja package's out path, so
the ui derivation (exposed via passthru.ui) never actually reached the
cachix cache even though it gets built as a dependency.

The new update target (scripts/update-versions.sh) checks GitHub for the
latest invoiceninja release and the latest invoiceninja/ui tag, bumps
whichever changed in package.nix, and iteratively rebuilds -- parsing
each hash-mismatch error Nix reports for a fixed-output derivation -- to
fill in the correct src/npmDeps/vendor hashes automatically.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

justfile

@@ -36,11 +36,17 @@ boot-vm:
 test:
     nix flake check -L
 
+[doc('Update invoiceninja and ui to their latest upstream versions, recomputing hashes')]
+[group('maintenance')]
+update:
+    ./scripts/update-versions.sh
+
 [doc('Build the package and automated test, then push results to the invoiceninja-nixos cachix cache')]
 [group('maintenance')]
 push-cache:
     nix build --print-out-paths --no-link \
         ".#invoiceninja" \
+        ".#invoiceninja.ui" \
         ".#checks.x86_64-linux.invoiceninja" \
         | cachix push invoiceninja-nixos