feat: add config hash comparison in unified customer page

Compare controller's config_hash from reports against Hub-generated
YAML hash. Shows sync status (in sync / mismatch / unknown) on the
unified customer detail page next to the Push Config button.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hub/internal/web/templates/customer_unified.html

@@ -370,6 +370,17 @@
                 </div>
                 {{end}}
             </div>
+            {{if and .HasConfig .ConfigSyncStatus}}
+            <div class="info-item" style="margin-top: 0.5rem;">
+                <span class="label">Config Sync</span>
+                <span class="value">
+                    {{if eq .ConfigSyncStatus "in_sync"}}<span style="color: #22c55e;">&#x2713; In sync</span>
+                    {{else if eq .ConfigSyncStatus "mismatch"}}<span style="color: #f59e0b;">&#x26A0; Config mismatch — Hub config differs from controller</span>
+                    {{else}}<span style="color: #94a3b8;">Unknown — controller not reporting config hash (update controller)</span>
+                    {{end}}
+                </span>
+            </div>
+            {{end}}
             <div style="margin-top: 0.75em; display: flex; gap: 0.5rem; flex-wrap: wrap;">
                 {{if and .ControllerURL .UpdateAvailable}}
                 <button class="btn btn-sm" id="btn-trigger-update" onclick="triggerControllerUpdate('{{.CustomerID}}')">