feat(web): footer build SHA shows "(latest)" or "(N behind)"

Footer now compares the running SOURCE_COMMIT against origin/main via
Gitea's compare API and renders "build <sha> (latest)" when up to date
or "build <sha> (N behind)" otherwise — so it's obvious from any page
whether the deploy is current.

Per-SHA cache (60s TTL, 1.5s timeout) keeps the lookup off the hot path
in steady state. Network or parse errors return None and the parens
suffix is just hidden — the SHA itself always renders, so a flaky git
host can never break the layout.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/templates/_layout.html

@@ -33,7 +33,7 @@
     Mit ♥ programmiert für Annika
     {% if git_commit_short %}
     <span class="mx-1">·</span>
-    <span title="{{ git_commit }}">build {{ git_commit_short }}</span>
+    <span title="{{ git_commit }}">build {{ git_commit_short }}{% if git_status %} ({{ git_status }}){% endif %}</span>
     {% endif %}
 </footer>
 {% endblock %}