controller: immediate hub report push on geo change + always-report geo (B)

- Geo settings save and manual geo sync now fire an out-of-band, non-blocking hub
  report push (Router.reportPushNow seam, wired in main.go to BuildReport+Push in a
  goroutine) so the hub reflects the new geo state / clears a stale last_sync_error
  within seconds instead of after the next ~15-min cycle. Scope: geo handlers only.
- builder.go always populates report.GeoRestriction (Enabled=false, empty countries
  when nil/disabled) via new buildGeoRestrictionReport helper, so the hub always
  renders the geo section ("Inaktív" when off) instead of hiding it via omitempty.
- Tests: geo save success → push once; invalid country → no push (companion);
  buildGeoRestrictionReport(nil) → non-nil disabled (companion vs old nil-omit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/cmd/controller/main.go

@@ -573,6 +573,18 @@ func main() {
 
 	// --- Initialize API router ---
 	apiRouter := api.NewRouter(cfg, *configPath, sett, stackMgr, syncer, cpuCollector, backupMgr, metricsStore, updater, notifier, logger)
+	if hubPusher != nil {
+		// Out-of-band, non-blocking hub report push (e.g. after a geo settings change) so
+		// the hub reflects the new state immediately instead of after the next ~15-min cycle.
+		apiRouter.SetReportPushTrigger(func() {
+			go func() {
+				rep := report.BuildReport(cfg, *configPath, stackMgr, backupMgr, cpuCollector, metricsStore, Version, sett.GetStoragePaths(), sett.GetGeoRestriction(), logger)
+				if err := hubPusher.Push(rep); err != nil {
+					logger.Printf("[WARN] [report] Out-of-band geo report push failed: %v", err)
+				}
+			}()
+		})
+	}
 	if assetsSyncer != nil {
 		apiRouter.SetAssetsSyncer(assetsSyncer)
 	}