docs: update controller README and CHANGELOG for v0.20.0

Add config apply endpoint and config hash in reports to REST API
section, roadmap, and changelog.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,25 @@
 ## Changelog
 
+### What was just completed (2026-02-20 session 63)
+- **v0.20.0 — Hub Config Management (Phase B):**
+
+  Two new features enabling the Hub to manage and compare controller configuration remotely.
+
+  **Feature A — Config Apply Endpoint:**
+  - `router.go`: Added `POST /api/config/apply` — accepts YAML body from Hub, validates it's parseable via `config.LoadFromBytes()`, writes atomically to controller.yaml (`.tmp` + `os.Rename`), returns success JSON. Restart required to apply.
+  - `router.go`: Added `GET /api/config/hash` — returns SHA256 hex digest of current controller.yaml
+  - `router.go`: Router struct gained `configPath string` field; `NewRouter()` signature updated
+  - `config.go`: Added `LoadFromBytes([]byte)` — parses YAML without file I/O (for validation)
+  - `config.go`: Added `FileHash(path)` — SHA256 hex digest helper
+  - `main.go`: Config endpoints use same dual auth middleware as self-update (session OR Hub API key Bearer token)
+  - `main.go`: Added `/api/config/` mux entry with `selfUpdateAuthMiddleware`
+
+  **Feature B — Config Hash in Reports:**
+  - `types.go`: Added `ConfigHash string` field to `Report` struct (JSON: `config_hash`)
+  - `builder.go`: `BuildReport()` now accepts `configPath string` parameter, computes SHA256 of controller.yaml and includes it in every report
+  - `main.go`: All 4 `BuildReport()` call sites updated to pass `*configPath`
+  - Hub uses this hash to compare against its generated YAML — shows "In sync" / "Config mismatch" / "Unknown" on the unified customer detail page
+
 ### What was just completed (2026-02-20 session 62)
 - **docker-setup.sh — Hub Config Download:**
   - Added `--hub-customer` and `--hub-password` CLI flags for downloading pre-configured controller.yaml from Felhom Hub