fix(image-updates): explain persistent digest rebuilds after update (#1784)

* fix(image-updates): explain persistent digest rebuilds after update

When an update completes but a same-tag digest rebuild is still detected,
the generic "update still detected" warning told operators nothing about
why. The digest comparison already knows the remaining updates are
digest-only (no higher tag), so recheckStack now returns a targeted
warning naming the two daemon-side causes: a registry mirror or cache
serving stale content, or a container still pinned to the previous image.

The digest-rebuild badge surfaces (Anatomy banner, Fleet cards, mobile)
now carry a tooltip with the same explanation, and the post-update
warning is added to the pre-update refresh sanitization set.

* fix(image-updates): surface digest warnings on editor and mobile paths

Editor Update discarded recheckWarning, digest hints were hover-only, and
service-scoped rechecks blamed the daemon when only sibling services remained stale.

backend/src/__tests__/stack-update-post-recheck.test.ts

@@ -6,6 +6,7 @@
 import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
 import request from 'supertest';
 import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
+import { UPDATE_DIGEST_UNCHANGED_WARNING } from '../services/ImageUpdateService';
 
 const {
   mockExecute,
@@ -166,6 +167,24 @@ describe('POST /api/stacks/:name/update post-compose verification', () => {
     );
   });
 
+  it('surfaces the digest-unchanged warning when the image digest did not move after update', async () => {
+    mockRecheckStack.mockImplementation(async () => {
+      callOrder.push('recheckStack');
+      return {
+        outcome: 'still_present',
+        warning: UPDATE_DIGEST_UNCHANGED_WARNING,
+      };
+    });
+
+    const res = await request(app)
+      .post('/api/stacks/web/update')
+      .set('Cookie', authCookie)
+      .send({ skip_scan: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.recheckWarning).toBe(UPDATE_DIGEST_UNCHANGED_WARNING);
+  });
+
   it('keeps HTTP 200 and success notification when recheck throws after Compose', async () => {
     mockRecheckStack.mockImplementation(async () => {
       callOrder.push('recheckStack');