feat: drill-down filters on overview and outdated agent version highlight

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_agent_version.py

@@ -0,0 +1,68 @@
+"""Agent version parse/compare for outdated highlighting."""
+
+from app.services.agent_version import is_agent_version_outdated, latest_agent_versions_by_product, parse_agent_version
+from app.models import Host
+from datetime import datetime, timezone
+
+
+def test_parse_agent_version():
+    assert parse_agent_version("2.0.25-SAC") == parse_agent_version("2.0.25")
+    assert parse_agent_version("bad") is None
+    assert parse_agent_version(None) is None
+
+
+def test_outdated_same_minor_patch_lag():
+    latest = "2.0.25-SAC"
+    assert is_agent_version_outdated("2.0.25-SAC", latest) is False
+    assert is_agent_version_outdated("2.0.24-SAC", latest) is False
+    assert is_agent_version_outdated("2.0.23-SAC", latest) is False
+    assert is_agent_version_outdated("2.0.22-SAC", latest) is True
+    assert is_agent_version_outdated("2.0.18-SAC", latest) is True
+    assert is_agent_version_outdated("2.0.20-SAC", latest) is True
+
+
+def test_outdated_different_minor_or_major():
+    latest = "2.0.1-SAC"
+    assert is_agent_version_outdated("1.2.5-SAC", latest) is True
+    assert is_agent_version_outdated("2.1.0-SAC", latest) is False
+
+
+def test_latest_agent_versions_by_product(db_session):
+    now = datetime.now(timezone.utc)
+    db_session.add_all(
+        [
+            Host(
+                hostname="linux-a",
+                os_family="linux",
+                product="ssh-monitor",
+                product_version="1.2.5-SAC",
+                last_seen_at=now,
+            ),
+            Host(
+                hostname="linux-b",
+                os_family="linux",
+                product="ssh-monitor",
+                product_version="2.0.1-SAC",
+                last_seen_at=now,
+            ),
+            Host(
+                hostname="win-a",
+                os_family="windows",
+                product="rdp-login-monitor",
+                product_version="2.0.18-SAC",
+                last_seen_at=now,
+            ),
+            Host(
+                hostname="win-b",
+                os_family="windows",
+                product="rdp-login-monitor",
+                product_version="2.0.25-SAC",
+                last_seen_at=now,
+            ),
+        ]
+    )
+    db_session.commit()
+
+    latest = latest_agent_versions_by_product(db_session)
+    assert latest["ssh-monitor"] == "2.0.1-SAC"
+    assert latest["rdp-login-monitor"] == "2.0.25-SAC"