hub v0.39.0: offsite hardening — F4 credential re-issue, F2 scan retry, F5 save UX

F4: ReissueCredentials — explicit operator recovery for consumed-password
dead-ends; resets the labelled resource's password (exactly-1 guard,
red-proofed), stores a fresh one-time secret, bumps ConfigVersion.
New hetznerapi.ResetBoxPassword for the dedicated path.
F2: host-key scan retry-with-backoff (~60s ladder, red-proofed) — first
save survives fresh-subaccount DNS lag.
F5: config form disables submits + shows an in-flight notice (the re-click
bait that caused live F1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/configs.go

@@ -537,6 +537,50 @@ func (s *Server) handleConfigUpdate(w http.ResponseWriter, r *http.Request, cust
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=updated", http.StatusSeeOther)
 }
 
+// handleOffsiteReissue (F4) resets the customer's offsite credential and stores a fresh one-time password —
+// the explicit operator recovery for a consumed-password dead-end (fresh-guest DR, consumed-but-failed
+// install). Scoped to the resource labelled for THIS customer (the provisioner refuses unless exactly one).
+// The config is re-saved unchanged so ConfigVersion bumps → the stuck guest's next refresh re-runs the
+// bridge, which consumes the fresh password. The password value is never logged or rendered.
+func (s *Server) handleOffsiteReissue(w http.ResponseWriter, r *http.Request, customerID string) {
+	if s.offsite == nil {
+		http.Error(w, "Offsite provisioning is not configured on this hub", http.StatusBadGateway)
+		return
+	}
+	cfg, err := s.store.GetCustomerConfig(customerID)
+	if err != nil || cfg == nil {
+		http.NotFound(w, r)
+		return
+	}
+	var overrides struct {
+		Offsite struct {
+			Enabled bool   `json:"enabled"`
+			Type    string `json:"type"`
+		} `json:"offsite"`
+	}
+	_ = json.Unmarshal([]byte(cfg.ConfigJSON), &overrides)
+	if !overrides.Offsite.Enabled || overrides.Offsite.Type == "" {
+		http.Error(w, "No provisioned offsite tier for this customer", http.StatusBadRequest)
+		return
+	}
+	// Same detached-ctx discipline as applyOffsite (F1): once the reset starts, reset→store must complete.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(r.Context()), 3*time.Minute)
+	defer cancel()
+	if err := s.offsite.ReissueCredentials(ctx, customerID, overrides.Offsite.Type); err != nil {
+		s.logger.Printf("[ERROR] offsite reissue for %s: %v", customerID, err)
+		http.Error(w, "Offsite credential re-issue failed: "+err.Error(), http.StatusBadGateway)
+		return
+	}
+	// Re-save unchanged → ConfigVersion bump → the customer's controller re-pulls + re-runs the bridge.
+	if err := s.store.SaveCustomerConfig(cfg); err != nil {
+		s.logger.Printf("[ERROR] offsite reissue for %s: config bump failed: %v", customerID, err)
+		http.Error(w, "Credential re-issued but the config bump failed — save the config once to trigger the pickup", http.StatusInternalServerError)
+		return
+	}
+	s.logger.Printf("[INFO] offsite credentials re-issued for %s (fresh one-time password stored; ConfigVersion bumped)", customerID)
+	http.Redirect(w, r, "/customers/"+customerID+"?flash=offsite_reissued", http.StatusSeeOther)
+}
+
 // handleConfigDelete deletes a customer config.
 func (s *Server) handleConfigDelete(w http.ResponseWriter, r *http.Request, customerID string) {
 	if err := s.store.DeleteCustomerConfig(customerID); err != nil {