geenforce: first dashboard card, and the widget contract it proves

Wave one of the dashboard proposal, built as a vertical slice so the contract
is proven by something real before the other five cards follow.

GET /api/geenforce/dashboard/failures lists entries that FAILED on their PC's
most recent enforcement cycle. Per ENTRY, not per report: "three PCs failed" is
a number, while "Install OpenText failed with exit 1603 on WJSF1234" is
something a person can act on. Only current reports count, so a failure that
has since been fixed clears itself instead of needing dismissing. Hostnames
resolve to computerids in one query so each row links to the PC, and a PC
shopdb does not know still appears - the failure is real even when the
inventory is behind, and that is the bay most likely to be misconfigured.

The data has been there all along. The only way to see any of it was to open
one PC's report modal, one PC at a time.

The widget declaration is the contract change. The old shape named a Vue
component per widget, which cannot survive a lean build where a plugin's
component may never be staged into the bundle - which is exactly why five
plugins declare widgets pointing at components nobody ever wrote. This declares
data, a generic renderer, a permission and a link template, the way ADR-010
already does for asset panels. A test asserts no 'component' key, so the old
shape cannot creep back.

empty: hide is part of the contract, not decoration. A card reporting "nothing
wrong" daily teaches people to stop reading the page, which is how a fleet log
reached 3,234 lines with 17 that mattered.

Frontend rendering comes next; the endpoint and declaration stand alone and
change nothing that exists.

plugins/geenforce/plugin.py

@@ -66,6 +66,42 @@ class GeEnforcePlugin(BasePlugin):
             ManifestEnforcementReport, ManifestEnforcementResult, PcTypeAlias,
         ]
 
+    def get_dashboard_widgets(self) -> List[Dict]:
+        """Dashboard cards this plugin contributes.
+
+        DATA AND SHAPE, not a component name. The older widget contract named a
+        Vue component per widget, which cannot survive a lean build - a
+        plugin's component may never be staged into the frontend bundle - and
+        is why five plugins declared widgets pointing at components nobody ever
+        wrote. Core owns a small set of generic renderers; a plugin says what
+        to show and how to link it. Same lesson ADR-010 already applied to
+        asset panels.
+
+        `empty: hide` matters as much as the data. A card that reports "nothing
+        wrong" every day teaches people to stop reading the page, which is
+        exactly how a fleet log reached 3,234 lines with 17 that mattered.
+        """
+        return [
+            {
+                'id': 'geenforce-failures',
+                'title': 'Enforcement failures',
+                'endpoint': '/api/geenforce/dashboard/failures',
+                'render': 'exceptions',
+                'severity': 'critical',
+                'permission': 'geenforce.manage',
+                'empty': 'hide',
+                'position': 10,
+                'map': {
+                    'title': 'hostname',
+                    'detail': 'entryname',
+                    'meta': [{'key': 'message'}, {'key': 'exitcode',
+                                                  'label': 'exit'}],
+                    'link': '/pcs/{computerid}',
+                    'timestamp': 'receivedat',
+                },
+            },
+        ]
+
     def get_permissions(self) -> List:
         """RBAC permissions this plugin owns (edit vs ship are split)."""
         return [