feat(web): footer build SHA shows "(latest)" or "(N behind)"

Footer now compares the running SOURCE_COMMIT against origin/main via
Gitea's compare API and renders "build <sha> (latest)" when up to date
or "build <sha> (N behind)" otherwise — so it's obvious from any page
whether the deploy is current.

Per-SHA cache (60s TTL, 1.5s timeout) keeps the lookup off the hot path
in steady state. Network or parse errors return None and the parens
suffix is just hidden — the SHA itself always renders, so a flaky git
host can never break the layout.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/common.py

@@ -24,6 +24,7 @@ import notifications
 from apply_client import ApplyClient, _row_to_profile
 from auth import issue_csrf_token
 from settings import APPLY_FAILURE_THRESHOLD, GIT_COMMIT, INTERNAL_API_KEY
+from version import commits_behind_main
 
 
 logger = logging.getLogger("web")
@@ -108,6 +109,13 @@ def require_internal(x_internal_api_key: str | None = Header(default=None)) -> N
 
 
 def base_context(request: Request, user, active_tab: str) -> dict:
+    behind = commits_behind_main(GIT_COMMIT)
+    if behind is None:
+        git_status = ""
+    elif behind == 0:
+        git_status = "latest"
+    else:
+        git_status = f"{behind} behind"
     return {
         "request": request,
         "user": user,
@@ -116,6 +124,7 @@ def base_context(request: Request, user, active_tab: str) -> dict:
         "is_admin": bool(user["is_admin"]),
         "git_commit": GIT_COMMIT,
         "git_commit_short": GIT_COMMIT[:7] if GIT_COMMIT and GIT_COMMIT != "dev" else GIT_COMMIT,
+        "git_status": git_status,
     }