hub: S2 /offsite registry page (read-only) + nav + WGPeer.CreatedAt

Endpoint card + peers table (truncated pubkeys with full-value title attr,
bound peers link to /hosts/<id>); Offsite nav link in all 9 page templates;
render tests for endpoint/peers, empty, and not-configured states.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/api/handler.go

@@ -1130,9 +1130,9 @@ var allowedEventTypes = map[string]bool{
 	"node_down":      true,
 	"node_recovered": true,
 	// Hub-generated host-domain events (v0.7.0, slice 3)
-	"host_stale":             true,
-	"host_down":              true,
-	"host_recovered":         true,
+	"host_stale":     true,
+	"host_down":      true,
+	"host_recovered": true,
 	// Hub-generated host root-fs disk-pressure (v0.23.0) — distinct from the controller's GUEST disk_*
 	"host_disk_warning":      true,
 	"host_disk_critical":     true,

hub/internal/api/wg_test.go

@@ -142,9 +142,9 @@ func TestWGPeers_BadPubkeyRejected(t *testing.T) {
 	putTestEndpoint(t, h)
 	bad := []string{
 		"not-base64",
-		base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 16)),      // 24 chars
-		"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",                       // 44 chars, not base64
-		base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 33)),      // 44 chars but 33 bytes
+		base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 16)), // 24 chars
+		"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",                 // 44 chars, not base64
+		base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 33)), // 44 chars but 33 bytes
 	}
 	for _, pk := range bad {
 		rr := do(h, http.MethodPost, "/admin/wg/peers", globalKey, `{"pubkey":"`+pk+`"}`)