hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

R-549 (operator ruling A): controllerStatus hardcoded 30m/1h while both
staleness checkers and hostStatus read alerting.stale_threshold. Moving the
threshold to 45m would have painted a customer amber 15 minutes before the
alarm could fire - the second definition rollup.go's header forbids. It now
reads the same value, down at 2x. Both 'checker initialized' log lines print
the threshold, which no line did before.

R-539 (ruling 3 of 2026-09-16): controller_slow_crashloop (warning,
operator-only), minted when the agent's slow_crashloop_since moves, with the
fast sibling's first-sight rule.

R-550: restore_interrupted (warning, for the household) allowlisted with a
Hungarian customer message.

Red-proofs, each seen failing then passing: the status test with the old
hardcoded numbers; the checker test with the movement branch removed; the
operator-only test with the registration removed; the household-message test
with the Hungarian entry removed (asserted on the SUBJECT - the body
legitimately repeats the raw message, which my first version of the test
mistook for a fallback).

go build/vet/test ./... green, 18 packages.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/handler.go

@@ -2121,6 +2121,11 @@ var allowedEventTypes = map[string]bool{
 	// report stanza (monitor/controller_supervisor.go). Both operator-only (notify.operatorOnlyEvents).
 	"controller_restarted_by_agent": true,
 	"controller_crashloop":          true,
+	// R-539 (hub v0.117.0, agent v0.132.0) — hub-generated from slow_crashloop_since; operator-only.
+	"controller_slow_crashloop": true,
+	// R-550 (hub v0.117.0, controller v0.246.0) — pushed by the controller at startup when it finds a
+	// restore that was in flight when the box stopped. For the household: they can run it again.
+	"restore_interrupted": true,
 	// R-509 / R-511 / R-518 / R-514 (hub v0.114.0). selfbind_link_sent and pbsdr_adopted are
 	// hub-internal audit rows (stored, not dispatched). backup_tier_skipped and app_oom are pushed by
 	// controller v0.243.0; both operator-only (notify.operatorOnlyEvents).