after_start deploy fields: asked after the start by this controller, still required for older ones (R-1028/R-1045, security review of catalog 0188430)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -41,6 +41,11 @@ Not released yet (bake → vouch → floor, `09` §3 decision 247). Design: felh
 - **„Kész" never opens an unclaimed Plex (R-1045)** — the controller asks Plex itself (`/identity` with the JSON Accept
   header) both after the claim and on the household's press. The live template carries NO probe: a controller before
   0.313.0 would send no Accept header and refuse the press forever. `TestPlexDonePress_RefusedWhileUnclaimed` (red-proved).
+- **`after_start:` deploy fields (R-1028/R-1045; a background security review of catalog `0188430`)** — this controller
+  does not ask such a field in the wizard and accepts it empty (Plex's claim code is asked on the Plex page after the
+  start); an older controller ignores the key and keeps the field required. The first catalog push had made the code
+  optional for EVERY controller, which let an old controller's „Kész" open an unclaimed Plex. `TestAfterStartField_*`
+  (red-proved).
 - **Old Sonarr/Radarr installs repaired by themselves (R-1047)** — only when /media is no longer bound: same-path root
   folder, `moveFiles:false` editor, rescan, old root removed, Radarr's collections too. `TestRepairOldRoot_K7`
   (red-proved: moveFiles=true is caught).