controller: customer-claim password gate v0.122.0 (closes DRILL-day0-vm F-4/F-5)

The customer sets + owns the dashboard password via a hub-emailed one-time
claim code. An unclaimed box (code hash present, no password) serves ONLY the
claim page — every other route → claim page (302) or 401, so a Day-0 box is
never open on the internet. A set password disables the gate (auth wins).
Reset rides the same code engine (login "Elfelejtett jelszó"). Legacy-open
(no password, no hash) shows a red transition banner until the hub delivers a
hash. Report ACK caches the code state idempotently by generation; report
carries claimed (set-only). --print-reset-code root escape hatch. Requires
hub v0.50.0. Gate-coverage signature test + 4 red-proofs proven.

controller/internal/web/templates/login.html

@@ -23,6 +23,7 @@
             </div>
             <button type="submit" class="btn btn-primary btn-full">Bejelentkezés</button>
         </form>
+        <p style="text-align:center;margin:0.75rem 0 0;font-size:0.85rem"><a href="/claim">Elfelejtett jelszó</a></p>
         <p class="login-footer">Felhom — Otthoni szerver kezelés<br>
         <a href="https://felhom.eu" target="_blank">felhom.eu</a></p>
     </div>