hub v0.84.0 — break-glass console credential on the host page

The credential existed and was not reachable when it was wanted. Every box has
had a strong random root@pam password since TASK G1, vaulted in the hub at day 0
and used for real during the sshd incident — but the only way to read it back was
a hand-written curl carrying the global operator key, a secret kept out-of-band.
In practice the PVE web console on a demo box felt locked.

The host page grows a Console access card: presence + username + set_at by
default, Reveal fetches the plaintext on demand for 60 s with a Copy button.
Masking clears the JS variable, and also fires on a second click and on
visibilitychange. A host with nothing vaulted says so, and says why.

The secret is NEVER rendered into the page, and that constraint shapes the
change. The render path uses a new store.GetHostRecoveryMeta whose struct and
SELECT both omit the secret column, so it is structurally incapable of carrying
one. The plaintext crosses the wire only in the response to POST
/hosts/{id}/reveal-recovery-credential (Cache-Control: no-store, CSRF-gated at
the ServeHTTP level; POST precisely so that gate applies and so no secret is
retrievable by URL alone). Deliberately NOT the customer page's data-secret
widget, which embeds the plaintext on every load.

A delivered reveal writes one recovery_credential_revealed event on the host's
customer timeline (info, source hub, Hungarian) via SaveEvent alone — no
dispatcher, nobody emailed, the log_tail_requested shape. Two reveals write two
events: the register records accesses, not states. A 404 is not an access. An
unbound host reveals fine and writes no event; the [INFO] hub line, carrying the
username and a length only, is then the record.

The global-key API path is untouched by design — it is the route for when the
hub UI itself is broken, and coupling it to the session layer would delete the
independence that makes it a fallback.

Recorded as a real trade: the hub session password alone now unlocks console root
fleet-wide, where retrieval previously also needed the global key. Accepted for a
single-operator, HU-geo-fenced hub that already stores these passwords in
plaintext at rest (CONTEXT.md ruling S-4). The plaintext-at-rest half is filed as
R-133 — every hub DB backup is a fleet-wide console-credential dump.

Tests 550 -> 559; four red-proofs (page leak, audit event, CSRF gate, route
order) each run, observed failing, and reverted. The route-order proof is a seam
test driving ServeHTTP: a handler-level test cannot see that defect, because the
handler is correct and simply never runs.

hub/internal/store/host_recovery.go

@@ -47,6 +47,34 @@ func (s *Store) GetHostRecoveryCredential(hostID string) (*HostRecoveryCredentia
 	return &c, nil
 }
 
+// HostRecoveryMeta is the NON-SECRET shape of a vaulted break-glass credential: what the operator's
+// host page shows without the plaintext ever entering the rendered document. The secret column is
+// deliberately absent from both the struct and the query — the render path must be unable to carry it.
+type HostRecoveryMeta struct {
+	HostID   string
+	Username string
+	SetAt    time.Time
+}
+
+// GetHostRecoveryMeta returns a host's credential metadata, or (nil, nil) if none is vaulted.
+// Use this — NOT GetHostRecoveryCredential — on any path that renders a page: the secret can only
+// leave the hub through the explicit, CSRF-gated, audited reveal endpoint.
+func (s *Store) GetHostRecoveryMeta(hostID string) (*HostRecoveryMeta, error) {
+	var m HostRecoveryMeta
+	var setAt string
+	err := s.db.QueryRow(
+		`SELECT host_id, username, set_at FROM host_recovery WHERE host_id = ?`, hostID).
+		Scan(&m.HostID, &m.Username, &setAt)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	m.SetAt = parseSQLiteTime(setAt)
+	return &m, nil
+}
+
 // HasHostRecoveryCredential reports whether a host already has a vaulted credential (day-0 idempotency:
 // don't regenerate/re-set on a re-run unless --rotate).
 func (s *Store) HasHostRecoveryCredential(hostID string) (bool, error) {

hub/internal/store/host_recovery_test.go

@@ -43,6 +43,43 @@ func TestHostRecoveryCredential_RoundTripUpsertAndAbsent(t *testing.T) {
 	}
 }
 
+// GetHostRecoveryMeta is the render path's accessor (hub v0.84.0). It returns username + set_at
+// and, by CONSTRUCTION, cannot return the secret: neither HostRecoveryMeta nor the SELECT names the
+// `secret` column, so there is no runtime assertion to write for that half — adding a Secret field
+// would not fail this test, it would fail to compile at every call site that never asked for one.
+// The runtime half asserted here is the metadata round-trip and the absent case.
+func TestGetHostRecoveryMeta_MetadataOnly(t *testing.T) {
+	s := newTestStore(t)
+	if err := s.UpsertHost(&Host{HostID: "h1", CustomerID: "c1", APIKey: "k1"}); err != nil {
+		t.Fatalf("UpsertHost: %v", err)
+	}
+
+	// absent → (nil, nil), never an error the page has to special-case
+	m, err := s.GetHostRecoveryMeta("h1")
+	if err != nil || m != nil {
+		t.Fatalf("absent meta: got %+v / %v (want nil,nil)", m, err)
+	}
+
+	if err := s.SaveHostRecoveryCredential("h1", "root@pam", "s3cret-Aa1"); err != nil {
+		t.Fatalf("SaveHostRecoveryCredential: %v", err)
+	}
+	m, err = s.GetHostRecoveryMeta("h1")
+	if err != nil || m == nil {
+		t.Fatalf("GetHostRecoveryMeta: %+v / %v", m, err)
+	}
+	if m.HostID != "h1" || m.Username != "root@pam" {
+		t.Fatalf("meta mismatch: %+v", m)
+	}
+	if m.SetAt.IsZero() {
+		t.Fatal("SetAt did not parse — the card cannot render staleness without it")
+	}
+
+	// an unknown host is the absent case too, not an error
+	if m, err := s.GetHostRecoveryMeta("nope"); err != nil || m != nil {
+		t.Fatalf("unknown host: got %+v / %v (want nil,nil)", m, err)
+	}
+}
+
 func TestGetHostMgmtPlaneStates_ParsesHealMarker(t *testing.T) {
 	s := newTestStore(t)
 	if err := s.UpsertHost(&Host{HostID: "h1", CustomerID: "c1", APIKey: "k1"}); err != nil {