v0.30.2: Report geo-restriction + logo/favicon update + Hub geo auth

- Add GeoRestrictionReport to report types and builder, so Hub can
  display geo-blocking status on customer detail pages
- Update all 5 BuildReport() call sites with new geoRestriction param
- Add /api/geo/ to selfUpdateAuthMiddleware (Hub Bearer token auth)
- Replace embedded logo SVG with updated logo.svg (white text variant)
- Add FelhomFaviconSVG constant + /static/favicon.svg route
- Update layout.html and catchall.html favicon links

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/report/builder.go

@@ -30,6 +30,7 @@ func BuildReport(
 	metricsStore *metrics.MetricsStore,
 	version string,
 	storagePaths []settings.StoragePath,
+	geoRestriction *settings.GeoRestriction,
 	logger *log.Logger,
 ) *Report {
 	debug := cfg.Logging.Level == "debug"
@@ -153,6 +154,23 @@ func BuildReport(
 	// App telemetry (metrics + log scan)
 	r.AppTelemetry = buildAppTelemetrySection(stackMgr, metricsStore, logger)
 
+	// Geo-restriction status
+	if geoRestriction != nil {
+		gr := &GeoRestrictionReport{
+			Enabled:          geoRestriction.Enabled,
+			AllowedCountries: geoRestriction.AllowedCountries,
+			LastSync:         geoRestriction.LastSync,
+			LastSyncError:    geoRestriction.LastSyncError,
+		}
+		if len(geoRestriction.AppOverrides) > 0 {
+			gr.AppOverrides = make(map[string]GeoAppOverrideReport, len(geoRestriction.AppOverrides))
+			for k, v := range geoRestriction.AppOverrides {
+				gr.AppOverrides[k] = GeoAppOverrideReport{AllowedCountries: v.AllowedCountries}
+			}
+		}
+		r.GeoRestriction = gr
+	}
+
 	if debug && logger != nil {
 		logger.Printf("[DEBUG] BuildReport: complete — containers=%d, health=%s, deployed=%d, available=%d, app_telemetry=%d",
 			r.Containers.Total, r.Health.Status, len(r.Stacks.Deployed), len(r.Stacks.Available), len(r.AppTelemetry))

controller/internal/report/types.go

@@ -22,7 +22,8 @@ type Report struct {
 	Backup            BackupReport     `json:"backup"`
 	Health            HealthReport     `json:"health"`
 	Stacks            StacksReport     `json:"stacks"`
-	AppTelemetry      []AppTelemetry   `json:"app_telemetry,omitempty"`
+	AppTelemetry      []AppTelemetry          `json:"app_telemetry,omitempty"`
+	GeoRestriction    *GeoRestrictionReport   `json:"geo_restriction,omitempty"`
 }
 
 // SystemReport holds host-level system info.
@@ -97,6 +98,20 @@ type StacksReport struct {
 	Available []string `json:"available"`
 }
 
+// GeoRestrictionReport holds geo-restriction status for hub display.
+type GeoRestrictionReport struct {
+	Enabled          bool                            `json:"enabled"`
+	AllowedCountries []string                        `json:"allowed_countries"`
+	AppOverrides     map[string]GeoAppOverrideReport `json:"app_overrides,omitempty"`
+	LastSync         string                          `json:"last_sync,omitempty"`
+	LastSyncError    string                          `json:"last_sync_error,omitempty"`
+}
+
+// GeoAppOverrideReport holds per-app country override.
+type GeoAppOverrideReport struct {
+	AllowedCountries []string `json:"allowed_countries"`
+}
+
 // AppTelemetry holds per-app (per-stack) resource and log telemetry.
 type AppTelemetry struct {
 	AppName         string             `json:"app_name"`