homebox: add required HBOX_AUTH_API_KEY_PEPPER (0.26 panics without it)

With the tag fixed so the image actually pulls, homebox 0.26.2 then panicked on
every start (16 restarts):

  panic: auth.api_key_pepper must be set to at least 32 bytes; generate with
  `openssl rand -base64 48` and provide via HBOX_AUTH_API_KEY_PEPPER.
  Rotating it invalidates all issued API keys

Added as a generated base64key:48 secret (matching upstream's own suggestion)
and marked data_key: true -- rotating it invalidates every issued API key, so
restore must recover the original rather than mint a new one.

Campaign 7 catalog sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

templates/homebox/.felhom.yml

@@ -29,6 +29,16 @@ deploy_fields:
     description: "A szerver domain neve"
     locked_after_deploy: true
 
+  - env_var: HBOX_AUTH_API_KEY_PEPPER
+    label: "API-kulcs pepper"
+    type: secret
+    generate: "base64key:48"
+    locked_after_deploy: true
+    # A Homebox 0.26+ pánikol induláskor, ha ez nincs beállítva (min. 32 bájt).
+    # Ez sózza az API-kulcsokat: ha újragenerálódik, MINDEN kiadott API-kulcs
+    # érvénytelenné válik, ezért visszaállításkor a régi értéket kell megtartani.
+    data_key: true
+
   - env_var: SUBDOMAIN
     label: "Aldomain"
     type: subdomain

templates/homebox/docker-compose.yml

@@ -18,6 +18,7 @@ services:
       - HBOX_LOG_LEVEL=info
       - HBOX_LOG_FORMAT=text
       - HBOX_WEB_MAX_UPLOAD_SIZE=50
+      - HBOX_AUTH_API_KEY_PEPPER=${HBOX_AUTH_API_KEY_PEPPER}
       - TZ=Europe/Budapest
     volumes:
       - homebox_data:/data