hub v0.37.0: offsite provisioning SLICE 1 — Cloud-API client + provisioning core

Hetzner storage-box provisioning against api.hetzner.com/v1 (NOT .cloud).
internal/hetznerapi (typed client + CloudAPI interface + Fake + WaitAction);
internal/offsite (Provisioner.ProvisionOffsite — idempotent by label, shared
sub-account/dedicated box, transient password, non-secret Descriptor,
fail-closed); one_time_secrets store (single-use Save/Consume); POST
/offsite/consume-password/{id} (customer-key auth, once); config-form Offsite
section → applyOffsite (502+no-save on error) → descriptor in ConfigJSON →
version bump. Token/passwords never logged/committed/in ConfigJSON. Tested vs a
faked Cloud API + fail-closed red-proof. NOT yet live-provisioned (needs the
dedicated-project scoped token; current token can delete ep0).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/server.go

@@ -18,6 +18,7 @@ import (
 
 	"gitea.dooplex.hu/admin/felhom-hub/internal/assets"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/gitea"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/offsite"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
 	"golang.org/x/crypto/bcrypt"
 )
@@ -56,7 +57,8 @@ type Server struct {
 	versionChecker  *VersionChecker
 	templateFetcher *TemplateFetcher
 	assetsMgr       *assets.Manager
-	gitea           *gitea.Client // optional; enables the Day-0 artifact version dropdowns
+	gitea           *gitea.Client       // optional; enables the Day-0 artifact version dropdowns
+	offsite         *offsite.Provisioner // optional; enables Hetzner offsite provisioning (SLICE 1)
 
 	sessions   map[string]*hubSession
 	sessionsMu sync.RWMutex
@@ -142,6 +144,10 @@ func (s *Server) SetAssetManager(am *assets.Manager) {
 	s.assetsMgr = am
 }
 
+// SetOffsiteProvisioner enables Hetzner offsite provisioning (optional). Without it, saving a config with
+// offsite enabled returns an error (offsite not configured on this hub).
+func (s *Server) SetOffsiteProvisioner(p *offsite.Provisioner) { s.offsite = p }
+
 // SetGiteaClient enables the Day-0 artifact version dropdowns (optional). Without it the artifact form
 // degrades to manual text entry.
 func (s *Server) SetGiteaClient(c *gitea.Client) {