hub: restore the host-delete escrow-ack gate (red-proof mutation swept by 146d165)

The parallel session's git add -A swept the v0.47.0 Part-4 WIP mid-red-proof:
hosts.go landed with the RED-PROOF 2 mutation (deleteEscrow := true), i.e. the
escrow acknowledgement bypassed. This restores the real gate; the swept store/
template/test files were captured in their correct final state (full go test
green). Red-proofs 1/2/5 all ran and FAILED as required before this point.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vvz1NCu22p8dGkRCpeX9re

hub/internal/web/hosts.go

@@ -394,7 +394,7 @@ func (s *Server) handleHostDelete(w http.ResponseWriter, r *http.Request, hostID
 		http.Error(w, "Confirmation does not match the host id — nothing deleted.", http.StatusBadRequest)
 		return
 	}
-	deleteEscrow := true // RED-PROOF 2: escrow-ack check dropped
+	deleteEscrow := r.FormValue("delete_escrow") == "1"
 	if err := s.store.DeleteHost(hostID, deleteEscrow); err != nil {
 		if errors.Is(err, store.ErrHostEscrowPresent) {
 			s.logger.Printf("[WARN] host delete refused: %s has key escrow (acknowledgement missing)", hostID)