0.36.0: per-stack image-update indicator on the Stacks overview

Shows an amber "Update" pill next to a stack's status (and highlights the
inline Update button) when any of the stack's images has a newer digest in
the registry. Reuses the existing background image-update check — a new
update_service.stacks_update_summary() reads the cached digests in a single
container sweep (no extra registry calls), exposed as GET /api/stacks/updates
and proxied per agent at GET /api/agents/{id}/stacks/updates. The Stacks page
and each remote-host section poll it every 60s.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/services/update_service.py

@@ -215,6 +215,38 @@ def stack_images(stack_id: str) -> set[str]:
     return images
 
 
+def stacks_update_summary() -> dict[str, dict]:
+    """Per-stack image-update status for every running compose project, read
+    from the digest cache the background loop maintains — no registry calls, so
+    it's cheap enough for the stacks list to poll. Stacks with no cached image
+    yet are simply absent (treated as "no update" by the UI)."""
+    by_stack: dict[str, set[str]] = {}
+    try:
+        client = get_client()
+        for c in safe_call(client.containers.list, all=True):
+            project = (c.labels or {}).get("com.docker.compose.project")
+            if not project:
+                continue
+            cfg_image = c.attrs.get("Config", {}).get("Image")
+            if cfg_image:
+                by_stack.setdefault(project, set()).add(cfg_image)
+    except DockerError:
+        return {}
+
+    summary: dict[str, dict] = {}
+    for stack_id, images in by_stack.items():
+        stale = [
+            img
+            for img in images
+            if (st := _CACHE.get(img)) is not None and st.update_available
+        ]
+        summary[stack_id] = {
+            "update_available": bool(stale),
+            "stale_images": stale,
+        }
+    return summary
+
+
 async def stack_updates(stack_id: str, refresh: bool = True) -> dict:
     """Update status for one stack's images.