hub: S2 /offsite registry page (read-only) + nav + WGPeer.CreatedAt

Endpoint card + peers table (truncated pubkeys with full-value title attr,
bound peers link to /hosts/<id>); Offsite nav link in all 9 page templates;
render tests for endpoint/peers, empty, and not-configured states.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/wg.go

@@ -42,6 +42,7 @@ type WGPeer struct {
 	AssignedIP string // bare IP — the /32 suffix is presentation, not storage
 	HostID     string
 	Note       string
+	CreatedAt  string // as stored (SQLite datetime text); display-only
 }
 
 // SetWGEndpoint upserts the (single expected) endpoint record.
@@ -318,7 +319,7 @@ func (s *Store) RemoveWGPeer(pubkey string) error {
 // ListWGPeers returns all registered peers ordered by assigned_ip — a deterministic order so
 // the sync payload bytes are stable for identical registries.
 func (s *Store) ListWGPeers() ([]WGPeer, error) {
-	rows, err := s.db.Query(`SELECT pubkey, assigned_ip, host_id, note FROM wg_peers ORDER BY assigned_ip`)
+	rows, err := s.db.Query(`SELECT pubkey, assigned_ip, host_id, note, created_at FROM wg_peers ORDER BY assigned_ip`)
 	if err != nil {
 		return nil, err
 	}
@@ -326,7 +327,7 @@ func (s *Store) ListWGPeers() ([]WGPeer, error) {
 	var peers []WGPeer
 	for rows.Next() {
 		var p WGPeer
-		if err := rows.Scan(&p.Pubkey, &p.AssignedIP, &p.HostID, &p.Note); err != nil {
+		if err := rows.Scan(&p.Pubkey, &p.AssignedIP, &p.HostID, &p.Note, &p.CreatedAt); err != nil {
 			return nil, err
 		}
 		peers = append(peers, p)