hub v0.28.0 + host-install v1.2.0: settings→Configuration, online install, vmid auto-detect

Part A (hub): move the global-floor + Day-0-artifacts cards from the Customers
page to the Configuration tab; routes → /configuration/{global-floor,artifacts};
redirects + flashes to /configuration. Customers page back to list + Add.

Part B: online setup command on the customer page (download-then-run, passphrase
at prompt, not templated); serve /scripts/ from the website (sparse-checkout +
nginx location) so felhom.eu/scripts/felhom-host-install.sh resolves; script
passphrase prompt reads < /dev/tty (works for pipe-to-bash too).

Part C (script): --vmid auto-detect — default 9201 in use + no --force → pick the
next free id from pct+qm and confirm; explicit --vmid stays die-unless-force.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/web/server.go

@@ -241,13 +241,14 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		} else {
 			s.handleConfigNewForm(w, r)
 		}
-	case path == "/configs/global-floor":
+	// Global settings live under the Configuration tab (moved from Customers).
+	case path == "/configuration/global-floor":
 		if r.Method == http.MethodPost {
 			s.handleSetGlobalFloor(w, r)
 		} else {
 			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		}
-	case path == "/configs/artifacts":
+	case path == "/configuration/artifacts":
 		if r.Method == http.MethodPost {
 			s.handleSetArtifacts(w, r)
 		} else {
@@ -587,8 +588,11 @@ func (s *Server) handleConfiguration(w http.ResponseWriter, r *http.Request) {
 
 	data := map[string]interface{}{
 		"CSRFToken":     csrfToken,
+		"CSRFField":     s.csrfField(r),
 		"AssetCount":    assetCount,
 		"AssetLastSync": assetLastSync,
+		"GlobalFloor":   s.store.GetGlobalMinControllerVersion(),
+		"Artifacts":     s.store.GetArtifactManifest(),
 		"Flash":         r.URL.Query().Get("flash"),
 	}
 	if err := s.templates.ExecuteTemplate(w, "configuration.html", data); err != nil {