build(docker): Identify images that preserve admin updates

- Mark compatible runtime images with the admin update capability label
- Keep the Dockerfile template and both generated Dockerfiles aligned
- Let the host updater reject images that would remove the update endpoint

docker/Dockerfile.alpine

@@ -128,6 +128,7 @@ RUN . /env-cargo && \
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.24
+LABEL org.vaultwarden.admin-updates="1"
 
 ENV ROCKET_PROFILE="release" \
     ROCKET_ADDRESS=0.0.0.0 \

docker/Dockerfile.debian

@@ -152,6 +152,7 @@ RUN . /env-cargo && \
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim
+LABEL org.vaultwarden.admin-updates="1"
 
 ENV ROCKET_PROFILE="release" \
     ROCKET_ADDRESS=0.0.0.0 \

docker/Dockerfile.j2

@@ -187,6 +187,7 @@ RUN . /env-cargo && \
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM {{ runtime_stage_image[base] }}
+LABEL org.vaultwarden.admin-updates="1"
 
 ENV ROCKET_PROFILE="release" \
     ROCKET_ADDRESS=0.0.0.0 \