F5 (dashboard): surface 'route unpublished' for unhealthy/restarting deployed apps

Traefik only publishes a route to a healthy container, so an unhealthy deployed app
returns 404 at its URL though the container runs — previously shown only as 'Nem
egészséges' with no hint the URL is dead. New routeUnpublished() funcmap helper +
a distinct indicator on the dashboard and stacks cards (gated on .Deployed). Tests:
routeUnpublished across all states, real templateFS parses with the funcmap, and the
card guard renders the indicator only for deployed+unhealthy.

controller/internal/web/funcmap.go

@@ -30,6 +30,20 @@ func getTimezone() *time.Location {
 	return webTimezone
 }
 
+// routeUnpublished reports whether the reverse proxy (Traefik) is withholding a deployed stack's public
+// route because the container is not healthy. Traefik's docker provider only publishes a route to a
+// container that is healthy (or has no healthcheck); an unhealthy or restarting container yields a 404
+// at its URL even though the card "looks deployed". Templates use this to surface that distinctly (F5),
+// so an unhealthy app with a dead URL isn't mistaken for a merely-degraded-but-reachable one.
+func routeUnpublished(state stacks.ContainerState) bool {
+	switch state {
+	case stacks.StateUnhealthy, stacks.StateRestarting:
+		return true
+	default:
+		return false
+	}
+}
+
 // templateFuncMap returns the FuncMap used by all HTML templates.
 func (s *Server) templateFuncMap() template.FuncMap {
 	loc := getTimezone()
@@ -102,6 +116,7 @@ func (s *Server) templateFuncMap() template.FuncMap {
 				return false
 			}
 		},
+		"routeUnpublished": routeUnpublished,
 		"logoURL": func(slug string) string {
 			return s.cfg.AppLogoURL(slug)
 		},