controller: customer-claim password gate v0.122.0 (closes DRILL-day0-vm F-4/F-5)

The customer sets + owns the dashboard password via a hub-emailed one-time
claim code. An unclaimed box (code hash present, no password) serves ONLY the
claim page — every other route → claim page (302) or 401, so a Day-0 box is
never open on the internet. A set password disables the gate (auth wins).
Reset rides the same code engine (login "Elfelejtett jelszó"). Legacy-open
(no password, no hash) shows a red transition banner until the hub delivers a
hash. Report ACK caches the code state idempotently by generation; report
carries claimed (set-only). --print-reset-code root escape hatch. Requires
hub v0.50.0. Gate-coverage signature test + 4 red-proofs proven.

controller/internal/web/templates/layout.html

@@ -47,6 +47,14 @@
         </div>
     </nav>
     <main class="content">
+{{if .ClaimLegacyOpen}}
+<div class="alerts-container">
+    <div class="alert-banner alert-banner-error">
+        <span class="alert-icon"><svg class="ico"><use href="#i-triangle-alert"/></svg></span>
+        <span class="alert-message">A vezérlőpult még nincs jelszóval védve — a beállító kódot hamarosan e-mailben küldjük.</span>
+    </div>
+</div>
+{{end}}
 {{if .Alerts}}
 <div class="alerts-container">
     {{range .Alerts}}