fix: Update runtime config when toggling Docker update actions setting

The DisableDockerUpdateActions setting was being saved to disk but not
updated in h.config, causing the UI toggle to appear to revert on page
refresh since the API returned the stale runtime value.

Related to #1023

cmd/hashpw/main_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"errors"
 	"strings"
 	"testing"
 
@@ -34,3 +35,49 @@ func TestRunHashesPassword(t *testing.T) {
 		t.Fatalf("expected hash to validate against original password")
 	}
 }
+
+func TestRunError(t *testing.T) {
+	oldHashPassword := hashPassword
+	defer func() { hashPassword = oldHashPassword }()
+
+	hashPassword = func(password string) (string, error) {
+		return "", errors.New("forced error")
+	}
+
+	var out bytes.Buffer
+	code := run([]string{"hashpw", "password"}, &out)
+	if code != 1 {
+		t.Fatalf("expected exit code 1, got %d", code)
+	}
+	if !strings.Contains(out.String(), "Error: forced error") {
+		t.Fatalf("expected error message, got %q", out.String())
+	}
+}
+
+func TestMain(t *testing.T) {
+	oldOsExit := osExit
+	oldOsArgs := osArgs
+	oldStdout := stdout
+	defer func() {
+		osExit = oldOsExit
+		osArgs = oldOsArgs
+		stdout = oldStdout
+	}()
+
+	var exitCode int
+	osExit = func(code int) {
+		exitCode = code
+	}
+	osArgs = []string{"hashpw", "test-password"}
+	var out bytes.Buffer
+	stdout = &out
+
+	main()
+
+	if exitCode != 0 {
+		t.Fatalf("expected exit code 0, got %d", exitCode)
+	}
+	if !auth.CheckPasswordHash("test-password", strings.TrimSpace(out.String())) {
+		t.Fatalf("expected valid hash in output")
+	}
+}