1- -update 1 means perform an install, but 'force' it (like the checkbox in the GUI)
Its basically saying, 'yes, this is already installed, but I want to update it with the provided package'
The format is actually /splunk install app <path to app.package> -update 1 -auth username:password
If you have modifications in your ./local folder these 'should' be preserved.
I say 'should', because an app from Splunkbase/vendor should not contain a /local folder (or it should be empty) - if it did contain files in /local these would also be replaced.
My approach is always download the package, unzip it and check first what it contains, then you know what it will/will not replace.
2- To update apps on a DS, or CM you should copy the app folder (once you have confirmed it is working as you expect) from your test server into the relevent path on the DS/CM