P3-09 + P3-X3: snapshot diff + recent-restores line

P3-09 — snapshot diff dispatcher.
- POST /api/hosts/{id}/snapshots/diff (and the unprefixed HTMX-form
  variant) takes {snapshot_a, snapshot_b}, validates both belong to
  the host (long id / short id / prefix match), checks the agent is
  online, mints a JobDiff, ships command.run with DiffPayload, writes
  a host.snapshot_diff audit row, returns HX-Redirect to the live
  job page (or JSON {job_id, job_url} for REST callers).
- Two-snapshot guard: POSTing diff(a,a) returns 422.
- UI: small panel on the host_detail right rail (visible when the
  host has 2+ snapshots) with two short-id inputs and a Diff button.
  Output renders on the standard live job page where the operator
  reads the per-line diff text directly.

P3-X3 — recent-restores line.
- hostChromeData grows RestoreStatus / RestoreAt / RestoreJobID
  populated via store.LatestJobByKind(host_id, 'restore') (already
  exists, used by the init line).
- host_chrome.html renders a small line below the existing init-status
  one with status-coloured copy + a link to the job log. Hidden when
  no restore has ever run on this host.

Tests:
- diff_test covers happy path (correct DiffPayload + HX-Redirect),
  same-id rejection (422), unknown-id rejection (422). Adds a
  seedTwoSnapshots helper since ReplaceHostSnapshots is atomic-swap
  (calling seedSnapshot twice would only leave the second).

Restage block (CLAUDE.md) deferred to the end of the restore phase.

web/templates/pages/host_detail.html

@@ -86,6 +86,25 @@
            class="btn btn-block">Restore from snapshot…</a>
       </div>
 
+      {{if gt $host.SnapshotCount 1}}
+      <div class="panel rounded-[7px] px-4 py-3.5">
+        <div class="text-[11px] text-ink-fade uppercase tracking-[0.1em] mb-2.5">Compare snapshots</div>
+        <p class="text-[12px] text-ink-mute leading-[1.55] mb-3">
+          Diff two snapshots to see what changed. Output streams to a live
+          job page like a regular run.
+        </p>
+        <form method="post" action="/hosts/{{$host.ID}}/snapshots/diff"
+              hx-post="/hosts/{{$host.ID}}/snapshots/diff" hx-swap="none"
+              class="space-y-2">
+          <input type="text" name="snapshot_a" placeholder="snapshot A id"
+                 class="field mono text-[11.5px]" />
+          <input type="text" name="snapshot_b" placeholder="snapshot B id"
+                 class="field mono text-[11.5px]" />
+          <button type="submit" class="btn btn-block">Diff →</button>
+        </form>
+      </div>
+      {{end}}
+
       <div class="panel rounded-[7px] px-4 py-3.5">
         <div class="text-[11px] text-bad uppercase tracking-[0.1em] font-semibold mb-2.5">Danger zone</div>
         <p class="text-pretty text-[12px] text-ink-mute leading-[1.55] mb-3">