controller: customer-claim password gate v0.122.0 (closes DRILL-day0-vm F-4/F-5)

The customer sets + owns the dashboard password via a hub-emailed one-time
claim code. An unclaimed box (code hash present, no password) serves ONLY the
claim page — every other route → claim page (302) or 401, so a Day-0 box is
never open on the internet. A set password disables the gate (auth wins).
Reset rides the same code engine (login "Elfelejtett jelszó"). Legacy-open
(no password, no hash) shows a red transition banner until the hub delivers a
hash. Report ACK caches the code state idempotently by generation; report
carries claimed (set-only). --print-reset-code root escape hatch. Requires
hub v0.50.0. Gate-coverage signature test + 4 red-proofs proven.

controller/internal/report/pusher.go

@@ -48,6 +48,9 @@ type PushResponse struct {
 	// ring; the NEXT report ships controller_log_tail (selftail.go). Absent/false on an
 	// old hub = nothing pending.
 	ControllerLogRequested bool `json:"controller_log_requested"`
+	// Claim (v0.122.0, F-4) — the hub's active claim-code state (bcrypt hash + generation) for
+	// the customer-claim gate. nil on an old hub / no claim row → the cache stays as-is.
+	Claim *ClaimStatus `json:"claim"`
 }
 
 // Pusher sends reports to the central hub.