R-970: the box's hub key opens no route; Data tab leftovers; R-1103: the install form's dead branches

R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with
every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer
door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using
those with a session. The route table is buildMux, so a test drives the real one.

Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's
status rows that repeated the form are gone (the no-target reason moves into the form).

R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests
that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/csrf.go

@@ -16,7 +16,6 @@ const csrfHeaderName = "X-CSRF-Token"
 //
 // Exempt cases:
 //   - Auth is disabled (no password configured)
-//   - Request has a valid Authorization: Bearer header (API key / hub auth)
 func (s *Server) CsrfProtect(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// Safe methods: no CSRF check needed
@@ -53,17 +52,9 @@ func (s *Server) CsrfProtect(next http.Handler) http.Handler {
 			return
 		}
 
-		// Skip CSRF for Bearer-token authenticated requests.
-		// Validate the token against the configured API key before skipping.
-		if auth := r.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") {
-			token := strings.TrimPrefix(auth, "Bearer ")
-			apiKey := s.cfg.Hub.APIKey
-			if apiKey != "" && subtle.ConstantTimeCompare([]byte(token), []byte(apiKey)) == 1 {
-				next.ServeHTTP(w, r)
-				return
-			}
-			// Invalid Bearer token — fall through to CSRF validation
-		}
+		// v0.322.0 (R-970): no Bearer exemption. It existed for the routes that accepted the box's hub API key
+		// (/api/config/, /api/selfupdate/, /api/geo/); none does now, so a request carrying that key is a dashboard
+		// request like any other and needs the session's CSRF token. Pinned by TestR970_HubKeyIsNoCSRFExemption.
 
 		// Get the session's CSRF token
 		cookie, err := r.Cookie(sessionCookieName)