ui: update chip + per-host button

- Surface UpdateAvailable + TargetVersion on the dashboard host row,
  the host_chrome header, and the JSON Host shape.
- New host_update_chip partial renders an amber out-of-date pill
  next to the agent-version display when the host's agent trails
  the server.
- Host detail right-rail gains an admin-only Update agent button
  (disabled when host is offline or already updating).
- New .update-chip and .btn-amber CSS tokens; tailwind output
  refreshed.

web/templates/pages/host_detail.html

@@ -78,6 +78,26 @@
         </p>
       </div>
 
+      {{if and $page.CanAdmin $page.UpdateAvailable}}
+      <div class="panel rounded-[7px] px-4 py-3.5">
+        <div class="text-[11px] text-ink-fade uppercase tracking-[0.1em] mb-2.5">Agent update</div>
+        <p class="text-[12px] text-ink-mute leading-[1.55] mb-3">
+          Agent at <span class="mono text-ink-mid">{{$host.AgentVersion}}</span> ·
+          server at <span class="mono text-ink-mid">{{$page.TargetVersion}}</span>.
+          Pushes a self-update command; the agent re-launches into the new binary
+          and reconnects.
+        </p>
+        <form hx-post="/hosts/{{$host.ID}}/update" hx-swap="none">
+          <button class="btn btn-amber btn-block"
+                  {{if not $page.Online}}disabled title="Agent must be online"
+                  {{else if $page.UpdateInProgress}}disabled title="Update already in progress"
+                  {{end}}>
+            Update agent
+          </button>
+        </form>
+      </div>
+      {{end}}
+
       <div class="panel rounded-[7px] px-4 py-3.5">
         <div class="text-[11px] text-ink-fade uppercase tracking-[0.1em] mb-2.5">Restore</div>
         <p class="text-[12px] text-ink-mute leading-[1.55] mb-3">

web/templates/partials/host_chrome.html

@@ -83,7 +83,7 @@
       <div class="flex items-center gap-3 mt-3 text-[13px] text-ink-mute">
         <span class="mono text-ink-mid">{{$host.OS}}/{{$host.Arch}}</span>
         <span class="text-ink-fade">·</span>
-        <span>agent <span class="mono text-ink-mid">{{if $host.AgentVersion}}{{$host.AgentVersion}}{{else}}—{{end}}</span></span>
+        <span>agent <span class="mono text-ink-mid">{{if $host.AgentVersion}}{{$host.AgentVersion}}{{else}}—{{end}}</span>{{if $page.UpdateAvailable}} {{template "host_update_chip" $page}}{{end}}</span>
         <span class="text-ink-fade">·</span>
         <span>restic <span class="mono text-ink-mid">{{if $host.ResticVersion}}{{$host.ResticVersion}}{{else}}—{{end}}</span></span>
         <span class="text-ink-fade">·</span>

web/templates/partials/host_row.html

@@ -14,7 +14,7 @@
     {{- end -}}
   </div>
   <div class="mono {{if eq $h.Status "offline"}}text-ink-mid{{else}}text-ink{{end}} font-medium">{{$h.Name}}</div>
-  <div class="mono text-ink-mid text-[12px]">{{$h.OS}}/{{$h.Arch}}</div>
+  <div class="mono text-ink-mid text-[12px]">{{$h.OS}}/{{$h.Arch}}{{if .UpdateAvailable}} {{template "host_update_chip" .}}{{end}}</div>
   <div class="text-xs text-ink-mid">
     {{- if $h.CurrentJobID -}}
       <span class="text-accent">backup running…</span><br>

web/templates/partials/host_update_chip.html

@@ -0,0 +1,11 @@
+{{/*
+  host_update_chip — small amber chip rendered when the agent version
+  on a host is behind the server's. Expects:
+    .UpdateAvailable bool
+    .TargetVersion   string
+    .Host            store.Host (for AgentVersion)
+  Hidden entirely when UpdateAvailable is false.
+*/}}
+{{define "host_update_chip"}}
+{{if .UpdateAvailable}}<span class="update-chip" title="Agent at {{.Host.AgentVersion}}; server at {{.TargetVersion}}">out of date · {{.Host.AgentVersion}} → {{.TargetVersion}}</span>{{end}}
+{{end}}