hub v0.15.0: Phase 2 managed updates — per-customer controller-version floor

Operator sets a minimum controller version (FLOOR), per-customer defaulting to a
global floor; the report ACK returns the effective floor + latest_version so the
controller auto-updates to the floor when below it (latest stays the opt-in button).

- store: min_controller_version column + hub_settings global floor + Effective/
  Get/SetGlobal/SetMin resolution + config/env DEFAULT_MIN_CONTROLLER_VERSION
- handler: report ACK {min_controller_version, latest_version}; LatestVersionProvider
- web: global floor editor + per-customer override form + Floor column (English)
- tests: floor resolution + ACK + render; override-precedence red-proof verified

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSZmmSFVzGwEzhYmxbkgBK

hub/internal/web/templates/customer_unified.html

@@ -433,6 +433,30 @@
                 </div>
                 {{end}}
             </div>
+            <!-- Phase 2 managed-update floor (operator-enforced minimum) -->
+            <div class="info-grid" style="margin-top: 0.75rem; border-top: 1px solid #334155; padding-top: 0.75rem;">
+                <div class="info-item">
+                    <span class="label">Effective floor (min. version)</span>
+                    <span class="value">
+                        {{if .EffectiveFloor}}v{{.EffectiveFloor}}
+                            {{if .BelowFloor}}<span style="color: #f59e0b; margin-left: 0.3em;">● below floor — will auto-update</span>
+                            {{else}}<span style="color: #94a3b8; margin-left: 0.3em;">— at/above floor</span>{{end}}
+                        {{else}}<span style="color: #94a3b8;">none (Phase 2 inert)</span>{{end}}
+                    </span>
+                </div>
+                <div class="info-item">
+                    <span class="label">Global floor</span>
+                    <span class="value">{{if .GlobalFloor}}v{{.GlobalFloor}}{{else}}<span style="color: #94a3b8;">unset</span>{{end}}</span>
+                </div>
+            </div>
+            <form method="POST" action="/customers/{{.CustomerID}}/floor" style="margin-top: 0.5rem; display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap;">
+                {{.CSRFField}}
+                <label style="font-size: 0.85em; color: #cbd5e1;">Per-customer override</label>
+                <input type="text" name="min_controller_version" value="{{.FloorOverride}}" placeholder="e.g. 0.87.0 (blank = use global)" style="padding: 0.3em 0.5em; font-size: 0.85em; width: 14em;">
+                <button class="btn btn-outline btn-sm" type="submit">Save floor</button>
+                <span style="font-size: 0.8em; color: #94a3b8;">Boxes below the effective floor auto-update on their next report. Blank clears the override.</span>
+            </form>
+
             {{if and .HasConfig .ConfigSyncStatus}}
             <div class="info-item" style="margin-top: 0.5rem;">
                 <span class="label">Config Sync</span>