manifests/hub: wire HETZNER_TOKEN + HETZNER_POOL_BOX_ID from Secret/storagebox (offsite provisioning)

Runbook Phase 0b. Values come from the out-of-band felhom-system/storagebox
secret; optional:true so the pod starts without it (hub degrades to offsite
disabled). HETZNER_LOCATION explicit fsn1. NOT synced yet — gated on the
secret holding the DEDICATED-project scoped token (the current one fails the
scope check: it sees the old project's ep0 box, not the new pool box).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

manifests/hub.yaml

@@ -171,16 +171,26 @@ spec:
                   name: wg-endpoint-ssh
                   key: hostkey
                   optional: true
+            # Offsite provisioning (SLICE 1+2): Hetzner Storage Box API token + the NUMERIC id of the
+            # pool box, from the out-of-band Secret/storagebox (NOT committed). The token MUST be scoped
+            # to the dedicated storage project — NEVER the shared-project token (it can touch ep0).
+            # HETZNER_POOL_BOX_ID is the numeric box id (console #id), not the box name. Optional so the
+            # pod starts before the secret exists (hub then logs offsite provisioning disabled).
             - name: HETZNER_POOL_BOX_ID
               valueFrom:
                 secretKeyRef:
                   name: storagebox
                   key: HETZNER_POOL_BOX_ID
+                  optional: true
             - name: HETZNER_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: storagebox
                   key: HETZNER_TOKEN
+                  optional: true
+            # Non-secret; the hub defaults to fsn1 anyway — explicit for clarity.
+            - name: HETZNER_LOCATION
+              value: "fsn1"
           resources:
             requests:
               memory: "64Mi"