R-970: the box's hub key opens no route; Data tab leftovers; R-1103: the install form's dead branches

R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with
every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer
door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using
those with a session. The route table is buildMux, so a test drives the real one.

Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's
status rows that repeated the form are gone (the no-target reason moves into the form).

R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests
that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/r709_password_field_test.go

@@ -41,21 +41,11 @@ func renderDeployWithPassword(t *testing.T, alreadyDeployed bool, restored bool)
 	return buf.String()
 }
 
-// COMPANION RED-PROOF: put `value="{{index $.DeployedFieldValues .EnvVar}}"` back on the deployed password input
-// → the first assertion fails with the password in the body.
-func TestR709_AnInstalledAppsPasswordIsNotInThePage(t *testing.T) {
-	html := renderDeployWithPassword(t, true, false)
-	if strings.Contains(html, testAdminPassword) {
-		t.Fatal("R-709: the installed app's admin password is in the HTML of its settings page")
-	}
-	if !strings.Contains(html, `onclick="revealPasswordField('grafana', 'ADMIN_PASSWORD', this)"`) {
-		t.Fatal("no reveal control: the household cannot see its own password")
-	}
-	// A login a restore generated is not the app's login (R-694): no reveal for it.
-	if html := renderDeployWithPassword(t, true, true); strings.Contains(html, `revealPasswordField('grafana'`) || strings.Contains(html, testAdminPassword) {
-		t.Fatal("a restore-generated login is offered for reveal")
-	}
-	// The pre-deploy form keeps its generator, with the field's own spec.
+// v0.322.0 (R-1103): the installed half of this test is retired — the install form no longer renders for an installed
+// app (R-1095). „The password is not in the page, an eye fetches it" is asserted on the settings tab
+// (TestAppPage_LoginPairPanel), and „no eye for a restore-generated login" too (TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin).
+// What stays here is the install form's own rule: it keeps its generator, with the field's spec.
+func TestR709_TheInstallFormKeepsItsGenerator(t *testing.T) {
 	if html := renderDeployWithPassword(t, false, false); !strings.Contains(html, `generatePassword('field-ADMIN_PASSWORD', 'field-confirm-ADMIN_PASSWORD', 'password:24:special')`) {
 		t.Fatal("the install form lost its generator (or its spec)")
 	}