Dashboard cards, backup last-seen

CHANGELOG.md

@@ -10,6 +10,22 @@ ADR-007 and ADR-002.
 
 ## [Unreleased]
 
+### Added
+
+- A backup now records that it was CHECKED, not only that it changed. Dedup
+  means an unchanged configuration writes no revision, so the stored timestamps
+  moved only on a change: a machine whose settings had been stable for six
+  months was indistinguishable from a machine whose backup died six months ago.
+  The only evidence a backup still ran was a line in a log file on the PC.
+  `lastseenat` is touched on every matching post, including the no-op, and is
+  backfilled from the timestamps that already exist.
+- Dashboard cards for enforcement failures, PCs not reporting, and backups that
+  have stopped. The dashboard now renders cards plugins declare, which it never
+  did before - five plugins had been declaring widgets into a void, pointing at
+  components nobody wrote. Cards are ordered by severity, hide themselves when
+  there is nothing to report, gate on a permission, and each fetches
+  independently so one broken endpoint cannot blank the board.
+
 ## [0.9.0] - 2026-08-11
 
 Driven by a fleet that had been failing quietly. A bay had been returning 500