feat(hub,install): break-glass recovery vault + mgmt_plane surfacing (TASK G1)

Hub half of the management-plane break-glass (prereq for felhom-sshd/H1; agent
half = felhom-agent v0.71.0). Closes SPIKE-felhom-sshd §8/#9.

- store.host_recovery + methods: per-host root@pam console password, at-rest,
  operator-retrievable (the PVE-web-console fallback when sshd + auto-heal both fail).
- API: PUT /hosts/{id}/recovery-credential (self-scoped, day-0 vaults) + GET
  /admin/hosts/{id}/recovery-credential (global key only). Secret never logged
  (red-proofed).
- monitor/host_mgmtplane: parses the agent mgmt_plane stanza, raises
  mgmt_plane_healed WARNING on a new privsep_healed_at (recurring clobber surfaces
  before lockout; complements host_staleness).
- host-install: step_break_glass generates a strong root@pam password (openssl
  rand, never logged/filed — stdin to chpasswd + curl), vaults via host key;
  idempotent unless --rotate-recovery. Installs the G1 host artifacts (tmpfiles +
  agent-independent watchdog timer), RuntimeDirectory-guarded; uninstall removes them.

Hub v0.34.0. Non-hollow tests + red-proofs; full suite green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/store.go

@@ -398,6 +398,24 @@ func (s *Store) migrate() error {
 		return err
 	}
 
+	// host_recovery (TASK G1): the break-glass root@pam console credential, vaulted at rest and
+	// operator-retrievable. UNLIKE host_escrow (opaque, hub-can't-open), this IS a hub-held secret the
+	// operator retrieves to reach the PVE web console (pveproxy — a failure domain distinct from sshd)
+	// when both the sshd path AND the agent-independent auto-heal have failed. One row per host,
+	// last-write-wins (day-0 sets it; --rotate re-sets). Never in desired-state, never logged.
+	_, err = s.db.Exec(`
+		CREATE TABLE IF NOT EXISTS host_recovery (
+			host_id     TEXT PRIMARY KEY,
+			username    TEXT NOT NULL,
+			secret      TEXT NOT NULL,
+			set_at      DATETIME NOT NULL DEFAULT (datetime('now')),
+			updated_at  DATETIME NOT NULL DEFAULT (datetime('now'))
+		);
+	`)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }