feat(update): wire update-db CLI handler

[Jordan231111]

Description

• wire update-db to the existing DatabaseUpdater using the shared app-data path
• format stable success and already-current output for the MVP CLI contract
• add mocked CLI coverage for already-current, --force, server/network failures, checksum mismatch, and corrupt manifest handling

This completes the MVP update-db CLI contract so end users can actually update their signature database from remote sources.

Related Issue

Closes #155
Closes #186
Closes #196
Closes #166
Closes #206

Type of Change

• Bug fix
• New feature
• Refactoring / CI / Docs
• Other

How to Test

• ./scripts/validate_strict.sh
• cargo test --test update_db_cli -- --nocapture
• cargo test integration::updater_fallback_test::test_updater_fallback_logic --test integration_tests -- --nocapture
• cargo test integration::database_tests::test_database_updater_no_update_when_version_matches --test integration_tests -- --nocapture
• cargo test integration::database_tests::test_database_updater_manifest_and_checksum --test integration_tests -- --ignored --nocapture

Checklist

• Code follows project style (cargo fmt + cargo clippy)
• Tests added/updated and passing (cargo test)
• Documentation updated (if applicable)