feat(health): surface pending-updates counts on the Health dashboard and CLI (ScadaBridge#63)

Health page gains PendingUpdatesHealthTiles (stale instances / sites with stale
artifacts, Deployer+Administrator only, site-scope narrowed, shared cache). New
GetPendingUpdates management command (Deployer) and 'health pending-updates' CLI
leaf. Flatten/cache computation untouched; the command reads
IPendingUpdatesEvaluator directly because the UI cache is not reachable from
ManagementService.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docs/components/CLI.md

@@ -122,7 +122,7 @@ scadabridge instance deploy --id 7
 | `bundle` | `export`, `preview`, `import` | Designer export; Administrator preview/import |
 | `audit` | `query`, `export`, `tree`, `backfill-source-node`, `verify-chain` | Audit roles; Administrator backfill; verify-chain is a local placeholder |
 | `audit-config` | `query` (config-change audit trail; was `audit-log` pre-M8) | `Admin` |
-| `health` | `summary`, `site`, `event-log`, `parked-messages` | Authenticated reads with server-side scope checks |
+| `health` | `summary`, `pending-updates`, `site`, `event-log`, `parked-messages` | Authenticated reads with server-side scope checks |
 | `debug` | `snapshot`, `stream` | `Deployer` |
 
 ### Selected examples

docs/components/ManagementService.md

@@ -179,7 +179,7 @@ There is **no** out-of-process actor path. The actor was advertised via `Cluster
 | Database connections | `ListDatabaseConnections`, `GetDatabaseConnection`, `CreateDatabaseConnectionDef`, `UpdateDatabaseConnectionDef`, `DeleteDatabaseConnectionDef` | Designer (mutations) |
 | Inbound API methods | `ListApiMethods`, `GetApiMethod`, `CreateApiMethod`, `UpdateApiMethod`, `DeleteApiMethod` | Designer (mutations) |
 | Security | `ListRoleMappings`, `CreateRoleMapping`, `UpdateRoleMapping`, `DeleteRoleMapping`, `ListApiKeys`, `CreateApiKey`, `UpdateApiKey`, `DeleteApiKey`, `SetApiKeyMethods`, `ListScopeRules`, `AddScopeRule`, `DeleteScopeRule` | Administrator |
-| Deployments | `MgmtDeployArtifacts`, `QueryDeployments`, `GetDeploymentDiff` | Deployer |
+| Deployments | `MgmtDeployArtifacts`, `QueryDeployments`, `GetDeploymentDiff`, `GetPendingUpdates` | Deployer |
 | Health | `GetHealthSummary`, `GetSiteHealth` | Any authenticated user |
 | Remote queries | `QueryEventLogsCommand`, `QueryParkedMessagesCommand` (any authenticated user); `RetryParkedMessageCommand`, `DiscardParkedMessageCommand`, `DebugSnapshotCommand` (Deployer) | Varies |
 | Audit (legacy) | `QueryAuditLog` | Administrator |

docs/requirements/Component-CLI.md

@@ -346,6 +346,7 @@ scadabridge audit verify-chain --month <YYYY-MM>
 ### Health Commands
 ```
 scadabridge health summary
+scadabridge health pending-updates
 scadabridge health site --identifier <site-identifier>
 scadabridge health event-log --site <site-identifier> [--event-type <type>] [--severity <level>] [--keyword <term>] [--from <date>] [--to <date>] [--page <n>] [--page-size <n>] [--instance-name <name>]
 scadabridge health parked-messages --site <site-identifier> [--page <n>] [--page-size <n>]

docs/requirements/Component-HealthMonitoring.md

@@ -42,6 +42,8 @@ Site clusters (metric collection and reporting). Central cluster (aggregation an
 | `SecretMirrorStatuses` | Site Runtime (`DeployedSecretsMirror` via the replicated `secret_mirror_status` table) | Every site node's deployed-secrets mirror status — node name, when the node last wrote the row (on a failure-set change, at start-up, or on the 10-min refresh), and its current failures (`{SecretName, Message}`; names and messages only, never values). Review finding M1: the **standby's** failures ride the **active** node's report, because each node writes its own row to a LocalDb-replicated table and the active node's `SecretMirrorStatusReporter` reads them all. **Nullable — null = no data** (central self-report, a pre-M1 site, reporter not yet run); an empty list = wired, no row yet; a node with an empty `Failures` list is healthy. Point-in-time (not drained on collect). Wire: `SiteHealthReportDto.secret_mirror_statuses` (field **33**, a presence wrapper so null ≠ empty). Drives the *Secret mirror failing* dashboard badge + per-node failure list. On an unreplicated pair only the active node's own row appears. A node that has not refreshed its row for `SiteRuntime:SecretMirrorStatusStaleAfter` (default 1 h — decommissioned, renamed or down) is left off and its row deleted. |
 | `LocalDbOplogBacklog` | Consolidated site LocalDb | Unacked oplog depth (Prometheus `localdb_oplog_depth`). **Nullable — null means "no reading", NOT "connected with an empty backlog"** (a failed poll rendered as 0 would report a pair that cannot read its own oplog as perfectly healthy). **Expected transient spikes:** the daily `site_events` retention purge and the storage-cap trim are CDC-captured like any other write, so the backlog jumps by the batch size at purge time and drains as the peer acks it — see `Component-SiteEventLogging.md` → Storage and `docs/deployment/topology-guide.md` → *Reading the replication backlog* for the healthy-versus-faulty signature. |
 
+**Pending-updates tiles (Gitea #63).** The Health dashboard also shows two central-computed counts — instances out of date and sites with stale artifacts — read from the same process-wide pending-updates cache as the rail indicator (no extra fleet flatten). Visible to Deployer/Administrator only and narrowed to a site-scoped operator's permitted sites. The CLI equivalent is `scadabridge health pending-updates` (`GetPendingUpdates`, Deployer role), which evaluates the fleet directly rather than through the UI cache.
+
 ## Reporting Protocol
 
 - Sites send a **health report message** to central at a configurable interval (default: **30 seconds**).

docs/requirements/Component-ManagementService.md

@@ -227,6 +227,7 @@ The two-person authorization workflow for writes through the MxAccess Gateway. B
 
 - **GetHealthSummary**: Query current health status of all sites.
 - **GetSiteHealth**: Query detailed health for a specific site.
+- **GetPendingUpdates**: Fleet-wide pending-updates counts (stale instances / sites with stale artifacts) with a per-site breakdown. Deployer role; site-scoped callers see only their permitted sites (Gitea #63).
 
 ### Remote Queries