controller: customer-claim password gate v0.122.0 (closes DRILL-day0-vm F-4/F-5)

The customer sets + owns the dashboard password via a hub-emailed one-time
claim code. An unclaimed box (code hash present, no password) serves ONLY the
claim page — every other route → claim page (302) or 401, so a Day-0 box is
never open on the internet. A set password disables the gate (auth wins).
Reset rides the same code engine (login "Elfelejtett jelszó"). Legacy-open
(no password, no hash) shows a red transition banner until the hub delivers a
hash. Report ACK caches the code state idempotently by generation; report
carries claimed (set-only). --print-reset-code root escape hatch. Requires
hub v0.50.0. Gate-coverage signature test + 4 red-proofs proven.

controller/internal/web/handlers.go

@@ -121,6 +121,9 @@ func (s *Server) baseData(page, title string) map[string]interface{} {
 		"Version":      s.version,
 		"AuthEnabled":  s.authEnabled(),
 		"DebugMode":    s.isDebug(),
+		// Customer-claim arc (v0.122.0, F-4): the transitional legacy-open banner — no password,
+		// no code hash yet. Cleared the moment the hub delivers a code hash (gate flips on).
+		"ClaimLegacyOpen": s.claimLegacyOpen(),
 	}
 	if s.alertManager != nil {
 		data["Alerts"] = s.alertManager.GetAlerts()