hub v0.55.0: accept offbox_enlarge_blocked event (Task 3a-fix delivery chain)

allowedEventTypes gains offbox_enlarge_blocked (was 400 at ingestion, dropping the customer email).
Deliberate NON-change: no customerMessages entry — the static map would discard the controller's
dynamic two-number Hungarian message (templates.go:129 fallback is correct). event_test acceptance +
400 red-proof; templates_offbox_test locks the raw-message fallback. manifest bumped to :0.55.0.

hub/internal/api/event_test.go

@@ -78,6 +78,25 @@ func TestHandleEvent_UnknownEventTypeRejected(t *testing.T) {
 	}
 }
 
+// Scenario D (controller v0.134.1): offbox_enlarge_blocked is an accepted controller-pushed type —
+// the enlarge-blocked notification's delivery chain starts at hub ingestion. Red-proof: removing the
+// allowlist entry makes this 400 (the pre-fix behavior that dropped the customer email).
+func TestHandleEvent_OffboxEnlargeBlockedAccepted(t *testing.T) {
+	h, st := newEventTestHandler(t)
+
+	rr := do(h, http.MethodPost, "/event", "ckey", eventBody("warning", "offbox_enlarge_blocked"))
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 (offbox_enlarge_blocked must be allowlisted); body=%s", rr.Code, rr.Body.String())
+	}
+	evs, err := st.GetRecentEvents("c1", 10)
+	if err != nil {
+		t.Fatalf("GetRecentEvents: %v", err)
+	}
+	if len(evs) != 1 || evs[0].EventType != "offbox_enlarge_blocked" {
+		t.Errorf("stored = %+v, want exactly one offbox_enlarge_blocked event", evs)
+	}
+}
+
 // Auth: no bearer at all is a 401 and stores nothing.
 func TestHandleEvent_Unauthorized(t *testing.T) {
 	h, st := newEventTestHandler(t)