v0.22.0: First-run setup wizard, local infra backup, hub verification

New controller features:
- Web-based setup wizard replaces docker-setup.sh interactive config
  - Dual listener: :8080 (Traefik) + :8081 (direct HTTP for LAN)
  - Drive scanner finds .felhom-infra-backup/ on all block devices
  - Hub recovery pull (GET /api/v1/recovery/{id}) with retrieval password
  - Fresh install: Hub config download or manual wizard
  - CSRF protection, state persistence, Hungarian UI
- Local infra backup written to all connected drives after each backup cycle
  - .felhom-infra-backup/backup.json + metadata.json with SHA256 checksum
- Hub verification: parse customer_blocked from report push response
  - Limited mode after 7 days without verification
- Recovery info page on Settings + recovery-info.txt file generation
- Pending events queue: DR events sent to Hub on next report push
- docker-setup.sh v6.0.0: removed interactive wizard, minimal controller.yaml only

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/CHANGELOG.md

@@ -1,5 +1,15 @@
 # scripts/ — Changelog
 
+## docker-setup.sh v6.0.0 (2026-02-21)
+
+- **Removed interactive configuration wizard**: Full setup now handled by controller's web-based setup wizard
+- **Minimal controller.yaml**: Script only generates domain + paths + listener config; controller's web wizard handles the rest
+- **New `--cf-tunnel-token` flag**: Cloudflare Tunnel token can now be provided directly via CLI
+- **Removed `--hub-customer` and `--hub-password` flags**: Hub config download moved to controller setup wizard
+- **Port 8081 mapping**: Controller docker-compose.yml now exposes `:8081` for direct HTTP setup wizard access
+- **Updated summary output**: Shows setup wizard URLs (domain + LAN fallback) instead of config file paths
+- **controller.yaml mount writable**: No longer `:ro` so setup wizard can write full config after completion
+
 ## docker-setup.sh v5.0.0 (2026-02-20)
 
 - **Hub Config Download:**