feat(swarm): expose needs_resync on TopologySummary + upsert record_error

Two small observability follow-ups to the phase-1 agent/topology wiring:

TopologySummary now carries needs_resync so operators can see the
heartbeat's resync flag via the topology list/detail API without
dropping into the DB.

TopologyStore.record_error becomes an upsert — when a docker/compose
failure fires during the first materialise (put() never reached), we
still land a marker row so GET /topology/state surfaces the error and
the next heartbeat carries an empty applied_version_hash. That empty
hash is what master's heartbeat check relies on to flag the topology
for resync instead of assuming the apply succeeded.

decnet/web/db/models.py

@@ -687,6 +687,7 @@ class TopologySummary(BaseModel):
     target_host_uuid: Optional[str] = None
     status: str
     version: int
+    needs_resync: bool = False
     created_at: datetime
     status_changed_at: Optional[datetime] = None