hub: dead-host roll-up honesty - customer status folds worst expected host

Customer status (dashboard row, /configs list, detail header + strip) is
now worst(controllerDerived, hostStatusOf(each expected host)) via the ONE
staleness definition (Server.hostStatus, hosts.go - shared with the
HostStalenessChecker; no second threshold). Any host down/stale caps the
customer at WARN with a cause chip naming the host ("host down: <id>");
pending (never-reported) hosts worsen only once the customer has reported
(onboarding exclusion). The three previously-inlined controller-status
chains collapse into controllerStatus() (rollup.go). Display + derivation
only - checker alerting untouched.

Live shape pinned (drill-1 / Peti cluster): host down 23h + controller
report minutes old rendered a GREEN row - TestRollup_DeadHostMasking now
fails that exact outcome. Red-proof: short-circuiting foldHostStatus to
controller-only flips C + two D subtests red ("dashboard row is GREEN
over a 23h-dead host").

hub/internal/web/server.go

@@ -611,6 +611,7 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 	type dashboardCustomer struct {
 		store.CustomerSummary
 		OverallStatus  string // "ok", "warn", "down", "pending"
+		HostCause      string // v0.53.0 roll-up: "" or "host down|stale|pending: <id>"
 		BackupAge      string
 		EventCriticals int
 		EventErrors    int
@@ -629,18 +630,9 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 		seen[c.CustomerID] = true
 		dc := dashboardCustomer{CustomerSummary: c}
 
-		// Determine overall status
-		if c.HealthStatus == "disabled" {
-			dc.OverallStatus = "disabled"
-		} else if c.TimeSinceReport > time.Hour {
-			dc.OverallStatus = "down"
-		} else if c.TimeSinceReport > 30*time.Minute || c.HealthStatus == "warn" {
-			dc.OverallStatus = "warn"
-		} else if c.HealthStatus == "fail" {
-			dc.OverallStatus = "down"
-		} else {
-			dc.OverallStatus = "ok"
-		}
+		// Controller-derived status + the v0.53.0 dead-host roll-up (rollup.go): a customer
+		// may never look better than its worst expected host.
+		dc.OverallStatus, dc.HostCause = s.foldHostStatus(c.CustomerID, controllerStatus(&c), true)
 
 		// Backup age
 		if c.BackupLastSnapshot != nil {
@@ -672,6 +664,9 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 			OverallStatus: "pending",
 			BackupAge:     "–",
 		}
+		// Roll-up for the never-reported customer too: a down/stale host worsens even during
+		// onboarding — only never-reported ("pending") hosts are excluded here.
+		dc.OverallStatus, dc.HostCause = s.foldHostStatus(cfg.CustomerID, dc.OverallStatus, false)
 		data = append(data, dc)
 	}