docs: add hub CHANGELOG.md, update ConfigMap with registry section

- hub/CHANGELOG.md: new file with v0.2.0 and prior version history
- manifests/hub.yaml: add registry config (version checker + template fetcher),
  pin image to v0.2.0, remove stale /healthz TODO comment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

manifests/hub.yaml

@@ -9,7 +9,7 @@
 #
 # PREREQUISITES:
 #   1. Build and push the hub image:
-#        cd ~/build/felhom-hub && ./build.sh 0.1.0 --push
+#        cd ~/build/felhom-hub && ./build.sh v0.2.0 --push
 #
 #   2. Generate a bcrypt password hash for dashboard login:
 #        htpasswd -nbBC 10 "" "your-password" | cut -d: -f2
@@ -82,6 +82,12 @@ data:
       stale_threshold: "30m"
     notifications:
       resend_api_key: "re_XZZenCJs_LyJnU12jZWfEn9rK85Gc83DK"
+    registry:
+      image: "gitea.dooplex.hu/admin/felhom-controller"
+      username: "admin"
+      token: "e93ef87f90cc13a476964ee965bfe2e75d945a33"
+      check_interval: "6h"
+      template_interval: "1h"
     server:
       listen: ":8080"
       data_dir: "/data"
@@ -111,7 +117,7 @@ spec:
     spec:
       containers:
         - name: hub
-          image: gitea.dooplex.hu/admin/felhom-hub:latest
+          image: gitea.dooplex.hu/admin/felhom-hub:v0.2.0
           ports:
             - containerPort: 8080
               name: http
@@ -130,10 +136,6 @@ spec:
               mountPath: /data
             - name: config
               mountPath: /etc/felhom-hub
-          # NOTE: When password_hash is set, GET / returns 401 for unauthenticated
-          # requests. The httpGet probe accepts 200-399 only, so it would fail.
-          # TODO: Add a /healthz endpoint in the hub code that bypasses auth.
-          # For now, probes work because password_hash is empty (no auth).
           livenessProbe:
             httpGet:
               path: /healthz