hub v0.3.5: Recovery endpoint + customer_blocked in report response

- New GET /api/v1/recovery/{customer_id}: returns generated controller.yaml
  and infra backup in a single response for disaster recovery.
  Auth via X-Retrieval-Password header.
- Report response now includes customer_blocked: true when customer
  status is "blocked" — controllers use this to detect standing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hub/README.md

@@ -4,7 +4,7 @@
 
 A lightweight Go service that receives periodic reports and structured events from felhom-controller instances, stores them in SQLite, and provides a web dashboard for fleet monitoring. Also serves as the infrastructure backup store for disaster recovery, event-based dead man's switch monitoring, and notification dispatch.
 
-**Current version: v0.3.4**
+**Current version: v0.3.5**
 
 ---
 
@@ -67,10 +67,32 @@ The infra-backup payload contains everything needed to restore a customer deploy
 
 **Disaster recovery flow:**
 1. Customer's system drive fails → replaced with fresh Debian install
-2. `docker-setup.sh` deploys controller with Hub details (customer_id + API key)
-3. Controller detects fresh deployment → calls `GET /api/v1/infra-backup/{customer_id}`
-4. Controller uses disk UUIDs to auto-mount surviving drives
-5. Controller restores apps from local backups on those drives
+2. `docker-setup.sh` deploys controller with minimal config (domain only)
+3. Controller enters setup wizard → user chooses restore from local drive or Hub
+4. For Hub restore: calls `GET /api/v1/recovery/{customer_id}` (gets config + infra backup)
+5. Controller uses disk UUIDs to auto-mount surviving drives
+6. Controller restores apps from local backups on those drives
+
+### Recovery (Disaster Recovery)
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/api/v1/recovery/{customer_id}` | Combined recovery: returns generated controller.yaml + infra backup in one response |
+
+Auth: `X-Retrieval-Password` header (same per-customer password as config retrieval). Response:
+```json
+{
+  "customer_id": "example",
+  "config_yaml": "customer:\n  id: example\n  ...",
+  "infra_backup": { ... },
+  "has_infra_backup": true
+}
+```
+If no infra backup exists yet, `infra_backup` is null and `has_infra_backup` is false.
+
+### Report Response
+
+The `POST /api/v1/report` response now includes `customer_blocked: true` when the customer's status is "blocked". Controllers use this to detect their standing and enter limited mode after a grace period.
 
 ### Events