ui: dashboard hosts-behind tile + filter

- Add ?updates=behind query filter and the matching dashboardFilter
  field; round-trips through encode/parse.
- Compute UpdatesBehind on the dashboard view-model (online + version
  trailing the server) and surface as an amber hero tile that links
  to the filtered list.
- Test exercise covering the new filter case.

web/templates/pages/dashboard.html

@@ -66,6 +66,16 @@
       </div>
     </div>
 
+    {{/* ---------- Hosts-behind hero tile (P6-18) ---------- */}}
+    {{if gt $page.UpdatesBehind 0}}
+      <div class="pt-4">
+        <a href="?updates=behind" class="hero-tile hero-tile--amber" style="display:inline-flex;">
+          <span class="hero-num">{{$page.UpdatesBehind}}</span>
+          <span class="hero-label">{{if eq $page.UpdatesBehind 1}}host behind{{else}}hosts behind{{end}} · review →</span>
+        </a>
+      </div>
+    {{end}}
+
     {{/* ---------- Pending hosts (announce-and-approve queue) ---------- */}}
     {{if gt (len $page.PendingHosts) 0}}
       <div class="pt-6">