A fork's repository home says "N commits behind <upstream>" from the last follow check, with its one action to update #5870

A repository that follows an outside upstream now shows one line under its head on its home page. Its tests pass, as do the related fork and follow suites and the design lint. bun x tsc --noEmit could not run here because the bun type definitions don't resolve in this sandbox, so the type check is unverified.

• Behind: the line reads 12 commits behind trevato/forge · checked 2h ago and links to /<owner>/<repo>/settings#upstream, where the follow check and updating already live. The upstream name is its owner/name path.
• Conflict: a conflicted fork reads can't follow: conflicts.
• No line: none is drawn at 0 behind, before the first check, when the last check failed for another reason, or for a repository that follows nothing.
• Timing: the line is built in behindLine in src/web/pages/upstream-follow.ts, from the stored getFollow row, with no git call. It is timed as a behind Server-Timing phase, and the test asserts it takes under 2 ms.
• Tests: test/repo-behind-line.test.ts covers behind, level, conflicted, not a fork, and a signed-out visitor who sees no line.

• Admins only: the line shows only to repo admins, like the existing "Following" line in the About card and the settings page it links to. Other viewers see nothing, so upstream URLs, which can be private, aren't exposed. Say so if you want it public.
• In-forge forks: forks of a repository on the same forge already get the git-read followingCard. I left that alone.
• Failed checks: a failed check, other than a conflict, draws no line. I didn't invent a message for it.

Closes #5867

A repository that follows an outside upstream now shows one line under its head on its home page. Its tests pass, as do the related fork and follow suites and the design lint. bun x tsc --noEmit could not run here because the bun type definitions don't resolve in this sandbox, so the type check is unverified.

• Behind: the line reads 12 commits behind trevato/forge · checked 2h ago and links to /<owner>/<repo>/settings#upstream, where the follow check and updating already live. The upstream name is its owner/name path.
• Conflict: a conflicted fork reads can't follow: conflicts.
• No line: none is drawn at 0 behind, before the first check, when the last check failed for another reason, or for a repository that follows nothing.
• Timing: the line is built in behindLine in src/web/pages/upstream-follow.ts, from the stored getFollow row, with no git call. It is timed as a behind Server-Timing phase, and the test asserts it takes under 2 ms.
• Tests: test/repo-behind-line.test.ts covers behind, level, conflicted, not a fork, and a signed-out visitor who sees no line.

• Admins only: the line shows only to repo admins, like the existing "Following" line in the About card and the settings page it links to. Other viewers see nothing, so upstream URLs, which can be private, aren't exposed. Say so if you want it public.
• In-forge forks: forks of a repository on the same forge already get the git-read followingCard. I left that alone.
• Failed checks: a failed check, other than a conflict, draws no line. I didn't invent a message for it.

I merged main into the branch and pushed it; the forge's own check hasn't reported on the new push yet.

• src/web/pages/repo.ts: the home page now shows both the "N commits behind" line from this pull and the "Latest:" wave line that came in from main.
• src/web/pages/upstream-follow.ts: I kept both sides: this pull's behindLine (with its upstreamShort helper) and main's historyList. The import now includes row, which historyList needs.

I ran 192 tests across the follow, upstream, behind and wave suites, and they all pass. I did not run the full bun test. bun x tsc --noEmit fails here with "Cannot find type definition file for 'bun'", so the type check did not run. That error comes from the sandbox's type setup rather than the merged code, but I haven't confirmed that.

I merged main into the branch, resolved the conflicts in src/web/pages/repo.ts, and pushed. The type check is clean. I ran only the upstream and repo test files, and they pass after one fix; I did not run the full bun test.

There were two conflicts, both in the repository home page, and I kept both sides:

• Imports: the "behind" line from this branch and main's upstream-offer imports are all imported now.
• Page body: the "behind" line is rendered where this branch had it, and main's upstream offer follows right after the archived line.

I also changed the timing test in test/repo-timing.test.ts. It lists the phases the repository home reports in Server-Timing. The test was out of date, not the code: this branch adds a "behind" phase, which now shows up between "wave" and "render". I added it to the expected list and to the test title.

I've pushed the changes for all of @juniper's points to the branch. The type check and design lint are clean, and the upstream, about and timing tests plus the behind-line test pass. I did not run the full bun test.

• Update button: a followed repository's home now has an "Update" button beside the count, in a POST form with no JS. It uses the same check action as the settings page. The form sends a back field, and the action redirects to the home only when back is exactly this repository's path. Anything else goes to settings as before, so there's no open redirect.
• CSRF: there is no CSRF token field. The forge protects its forms with the same-origin check in readForm, which this action already uses, so I followed that rather than add a token.
• Markup: the line is now a <div> rather than a <p>, because a form can't sit inside a paragraph. A "details" link to the settings section stays.
• Terminal: the repository About card (I) now has a behind row with the same words, and u on that card is the same update. behindWords in src/actions/upstream_follow.ts holds the wording for both doors, and the README says so.
• Non-admin test: a new case signs in as a second user who can read the repository and checks that they see no line and no button. Another case covers the redirect back to the home and the refusal of a foreign back.
• Flaky assertion: the < 2 ms check on the behind phase is gone. The test only checks the phase name, and repo-timing still checks the order.
• Conflict wording: it now reads "conflicts with owner/name: resolve", and the text links to the settings section.

I've pushed fixes for both of @juniper's points. The type check, design lint and the behind-line and about-card tests pass; I didn't run the full bun test. I haven't looked at a desktop screenshot of the Update button, because the sandbox can't take one. I confirmed it from the stylesheet instead: the form now uses form.inline from src/web/style/content.ts, which is plain inline layout with no opacity rule.

• Update button: it was invisible on desktop because the form used row-actions, which is transparent until a .row is hovered or focused. I replaced it with form.inline. That class also pushes the button to the right edge of the line (margin-left: auto).
• Terminal test: a new test in test/repo-behind-line.test.ts calls upstreamRows for a behind, a conflicting and a level repository. It expects the behind and conflict rows with their wording and u updates, and no row for the level one. It would fail without the row. It restores the stored checks first, because the Update test before it runs a real check that overwrites them.
• Cleanup: upstreamRows in src/tui/screens/about.ts now computes behindWords once, with no non-null assertion.