hub v0.39.0: offsite hardening — F4 credential re-issue, F2 scan retry, F5 save UX

F4: ReissueCredentials — explicit operator recovery for consumed-password
dead-ends; resets the labelled resource's password (exactly-1 guard,
red-proofed), stores a fresh one-time secret, bumps ConfigVersion.
New hetznerapi.ResetBoxPassword for the dedicated path.
F2: host-key scan retry-with-backoff (~60s ladder, red-proofed) — first
save survives fresh-subaccount DNS lag.
F5: config form disables submits + shows an in-flight notice (the re-click
bait that caused live F1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/templates/customer_unified.html

@@ -44,6 +44,7 @@
             {{if eq .Flash "created"}}Configuration created successfully.
             {{else if eq .Flash "updated"}}Configuration updated.
             {{else if eq .Flash "password_regenerated"}}Retrieval password regenerated.
+            {{else if eq .Flash "offsite_reissued"}}Offsite credentials re-issued — a fresh one-time password is staged; the controller picks it up on its next config refresh.
             {{else if eq .Flash "blocked"}}Customer blocked — hidden from Dashboard.
             {{else if eq .Flash "unblocked"}}Customer unblocked — visible on Dashboard again.
             {{end}}