ui: dashboard hosts-behind tile + filter

- Add ?updates=behind query filter and the matching dashboardFilter
  field; round-trips through encode/parse.
- Compute UpdatesBehind on the dashboard view-model (online + version
  trailing the server) and surface as an amber hero tile that links
  to the filtered list.
- Test exercise covering the new filter case.

internal/server/http/dashboard_filter_test.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"gitea.dcglab.co.uk/steve/restic-manager/internal/store"
+	"gitea.dcglab.co.uk/steve/restic-manager/internal/version"
 )
 
 func makeFilterHosts() []store.Host {
@@ -98,6 +99,23 @@ func TestSortDashboardHostsColumns(t *testing.T) {
 	}
 }
 
+// TestFilterAndSortDashboardUpdatesBehind: ?updates=behind narrows
+// to hosts whose agent_version is non-empty AND != server's version.
+func TestFilterAndSortDashboardUpdatesBehind(t *testing.T) {
+	t.Parallel()
+	hosts := []store.Host{
+		{ID: "01a", Name: "alpha", AgentVersion: "v0.0.1", Status: "online"},
+		{ID: "01b", Name: "bravo", AgentVersion: version.Version, Status: "online"},
+		{ID: "01c", Name: "charlie", AgentVersion: "", Status: "online"}, // never seen
+		{ID: "01d", Name: "delta", AgentVersion: "v0.0.1", Status: "offline"},
+	}
+	got := filterAndSortDashboardHosts(hosts, dashboardFilter{Updates: "behind", Sort: "name", Dir: "asc"})
+	// alpha + delta both behind; bravo (current) and charlie (empty) excluded.
+	if len(got) != 2 || got[0].Name != "alpha" || got[1].Name != "delta" {
+		t.Errorf("updates=behind: got %v", namesOf(got))
+	}
+}
+
 // TestParseDashboardFilterDefaults: empty query gives sort=name asc.
 func TestParseDashboardFilterDefaults(t *testing.T) {
 	t.Parallel()