controller: customer-claim password gate v0.122.0 (closes DRILL-day0-vm F-4/F-5)

The customer sets + owns the dashboard password via a hub-emailed one-time
claim code. An unclaimed box (code hash present, no password) serves ONLY the
claim page — every other route → claim page (302) or 401, so a Day-0 box is
never open on the internet. A set password disables the gate (auth wins).
Reset rides the same code engine (login "Elfelejtett jelszó"). Legacy-open
(no password, no hash) shows a red transition banner until the hub delivers a
hash. Report ACK caches the code state idempotently by generation; report
carries claimed (set-only). --print-reset-code root escape hatch. Requires
hub v0.50.0. Gate-coverage signature test + 4 red-proofs proven.

controller/internal/config/config.go

@@ -122,6 +122,14 @@ type WebConfig struct {
 	SetupListen   string `yaml:"setup_listen"` // Plain HTTP listener for setup wizard (only active during setup mode)
 	PasswordHash  string `yaml:"password_hash"`
 	SessionSecret string `yaml:"session_secret"`
+
+	// Customer-claim arc (v0.122.0, DRILL-day0-vm F-4): the hub-baked claim/reset code state —
+	// bcrypt(code) + monotonic generation + issue time (RFC3339). Day-0 configs carry these so a
+	// fresh box is claim-gated from FIRST boot; live boxes get fresher values via the report ACK
+	// (settings.json wins when its generation is newer). A set password always beats the gate.
+	ClaimCodeHash       string `yaml:"claim_code_hash"`
+	ClaimCodeGeneration int    `yaml:"claim_code_generation"`
+	ClaimCodeIssuedAt   string `yaml:"claim_code_issued_at"`
 }
 
 type GitConfig struct {
@@ -418,3 +426,9 @@ func (cfg *Config) AppScreenshotURL(slug string, index int) string {
 func (cfg *Config) AppPageURL(slug string) string {
 	return fmt.Sprintf("/apps/%s", slug)
 }
+
+// WebClaimGeneration returns the config-baked claim-code generation (0 when none). Satisfies the
+// web.ClaimHatchConfig seam for the --print-reset-code escape hatch.
+func (cfg *Config) WebClaimGeneration() int {
+	return cfg.Web.ClaimCodeGeneration
+}