hub: S2 /offsite registry page (read-only) + nav + WGPeer.CreatedAt

Endpoint card + peers table (truncated pubkeys with full-value title attr,
bound peers link to /hosts/<id>); Offsite nav link in all 9 page templates;
render tests for endpoint/peers, empty, and not-configured states.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/server.go

@@ -241,6 +241,9 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case strings.HasPrefix(path, "/apps/"):
 		appName := strings.TrimPrefix(path, "/apps/")
 		s.handleAppDetail(w, r, appName)
+	// Offsite — read-only WG endpoint + peer registry (S2). Mutations stay on the admin API.
+	case path == "/offsite":
+		s.handleOffsite(w, r)
 	// Hosts — read-only fleet view (audit F-M1). GET only; no host actions.
 	case path == "/hosts" || path == "/hosts/":
 		s.handleHostsList(w, r)