feat(report): Direction-2 immediate-sync wait channel client (v0.140.0)

report.Waiter holds a hanging GET against hub /api/v1/wait?gen=N (same hub
URL+key as the pusher). On a generation change it fires the v0.139.0
report.Trigger — nothing else; the report ACK delivers everything through the
unchanged machinery. No overall client timeout (held GET); per-request ctx
bounds a dead connection. First-observation records-not-fires; same-gen
timeout fires nothing; errors (incl. 404 from a pre-v0.58.0 hub) back off
5s->5min while the 15-min cycle reconciles. Wired beside the trigger under the
same hubPusher!=nil && Hub.Enabled gate.

Red-proof: disable the baseline branch -> first observation fires
(TestWaiter_FirstObservationRecordsNoFire), run-fail-reverted.

Copy soften: backups_remote/escrow "néhány másodperc, legfeljebb 15 perc".
Pairs with hub v0.58.0. Grounding:
felhom.eu/documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md

controller/cmd/controller/main.go

@@ -811,6 +811,14 @@ func main() {
 		}
 		reportTrigger = report.NewTrigger(fireReport, logger)
 		go reportTrigger.Run(ctx)
+
+		// Direction-2 immediate-sync (v0.140.0): hold a hanging GET against the hub's wait channel
+		// and fire the trigger the instant operator intent moves — so an operator save round-trips in
+		// seconds instead of on the next ~15-min cycle. Reuses the SAME hub URL + key as the pusher;
+		// no new config keys. Gated on the trigger existing (hub reporting enabled). The ACK from the
+		// fired report delivers everything through the unchanged machinery.
+		waiter := report.NewWaiter(cfg.Hub.URL, cfg.Hub.APIKey, reportTrigger.Fire, logger)
+		go waiter.Run(ctx)
 	}
 
 	// --- Initialize API router ---