hub v0.55.0: accept offbox_enlarge_blocked event (Task 3a-fix delivery chain)

allowedEventTypes gains offbox_enlarge_blocked (was 400 at ingestion, dropping the customer email).
Deliberate NON-change: no customerMessages entry — the static map would discard the controller's
dynamic two-number Hungarian message (templates.go:129 fallback is correct). event_test acceptance +
400 red-proof; templates_offbox_test locks the raw-message fallback. manifest bumped to :0.55.0.

hub/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Felhom Hub — Changelog
 
+## v0.55.0 — accept the offbox_enlarge_blocked event (Task 3a-fix delivery chain) (2026-07-15)
+
+The controller (v0.134.1) sends an `offbox_enlarge_blocked` warning when an app's enlarged offsite
+push is refused by the quota gate (config+DB still saved). This closes the **ingestion** link of its
+delivery chain.
+
+- **`internal/api/handler.go`:** `offbox_enlarge_blocked` added to `allowedEventTypes` — the event was
+  400-rejected before (the customer email was dropped at ingestion). Acceptance case +
+  400-red-proof added to `internal/api/event_test.go`.
+- **Deliberate NON-change:** NO `customerMessages` entry. `FormatCustomerEmail` (`templates.go:129`)
+  gives the static per-type message PRIORITY over the raw message, so a static entry would DISCARD
+  the controller's dynamic two-number Hungarian text (estimate + quota). The documented fallback (raw
+  message survives) is the correct path; locked by a new `internal/notify/templates_offbox_test.go`
+  assertion. `internal/notify/dispatcher.go` and the customer `EnabledEvents` whitelist are unchanged
+  here — the controller side (v0.134.1) owns `DefaultEnabledEvents` + the prefs migration + the
+  settings checkbox.
+
 ## v0.54.0 — operator login password changeable from the UI (2026-07-13)
 
 The hub login password was previously settable ONLY by editing the `auth.password_hash` field in