hub v0.28.0 + host-install v1.2.0: settings→Configuration, online install, vmid auto-detect

Part A (hub): move the global-floor + Day-0-artifacts cards from the Customers
page to the Configuration tab; routes → /configuration/{global-floor,artifacts};
redirects + flashes to /configuration. Customers page back to list + Add.

Part B: online setup command on the customer page (download-then-run, passphrase
at prompt, not templated); serve /scripts/ from the website (sparse-checkout +
nginx location) so felhom.eu/scripts/felhom-host-install.sh resolves; script
passphrase prompt reads < /dev/tty (works for pipe-to-bash too).

Part C (script): --vmid auto-detect — default 9201 in use + no --force → pick the
next free id from pct+qm and confirm; explicit --vmid stays die-unless-force.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/web/templates/configs.html

@@ -21,56 +21,10 @@
 
         {{if .Flash}}
         <div class="flash flash-success">
-            {{if eq .Flash "deleted"}}Customer configuration deleted.
-            {{else if eq .Flash "floor_set"}}Controller-version floor saved.
-            {{else if eq .Flash "floor_invalid"}}Invalid version — use X.Y.Z (or blank to clear).
-            {{else if eq .Flash "artifacts_set"}}Artifact manifest saved.
-            {{else if eq .Flash "artifact_ver_invalid"}}Invalid artifact version — use X.Y.Z (or blank to clear).
-            {{else if eq .Flash "artifact_sha_invalid"}}Invalid sha256 — use 64 hex chars (or blank to clear).
-            {{end}}
+            {{if eq .Flash "deleted"}}Customer configuration deleted.{{end}}
         </div>
         {{end}}
 
-        <!-- Phase 2 managed updates: global controller-version floor -->
-        <div class="card" style="margin-bottom: 1rem; padding: 1rem; border: 1px solid #334155; border-radius: 8px;">
-            <h2 style="margin: 0 0 0.5rem;">Managed updates — global floor</h2>
-            <p style="font-size: 0.85em; color: #94a3b8; margin: 0 0 0.5rem;">
-                The minimum controller version every box auto-updates to (unless a per-customer override is set).
-                Boxes below the floor update on their next report — no customer action. Blank = no global floor.
-            </p>
-            <form method="POST" action="/configs/global-floor" style="display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap;">
-                {{.CSRFField}}
-                <input type="text" name="min_controller_version" value="{{.GlobalFloor}}" placeholder="e.g. 0.86.0 (blank = none)" style="padding: 0.3em 0.5em; width: 14em;">
-                <button class="btn btn-sm" type="submit">Save global floor</button>
-                <span style="font-size: 0.85em; color: #cbd5e1;">Current: {{if .GlobalFloor}}<code>v{{.GlobalFloor}}</code>{{else}}<span class="text-muted">unset</span>{{end}}</span>
-            </form>
-        </div>
-
-        <!-- BUNDLE slice: Day-0 artifact manifest (agent binary + golden archive). The hub is the
-             checksum TRUST ROOT — the host-bootstrap script verifies Gitea-fetched artifacts against
-             these sha256s before installing them. Record the version + sha256 printed by
-             publish-agent.sh / build-golden.sh. -->
-        <div class="card" style="margin-bottom: 1rem; padding: 1rem; border: 1px solid #334155; border-radius: 8px;">
-            <h2 style="margin: 0 0 0.5rem;">Day-0 artifacts — agent &amp; golden</h2>
-            <p style="font-size: 0.85em; color: #94a3b8; margin: 0 0 0.5rem;">
-                The current agent binary + golden archive the host-bootstrap script fetches from Gitea and
-                verifies (sha256) before installing. The hub vouches for these checksums (a different trust
-                root than Gitea). Paste the version + sha256 printed by <code>publish-agent.sh</code> /
-                <code>build-golden.sh</code>. Blank a field to clear it.
-            </p>
-            <form method="POST" action="/configs/artifacts" style="display: grid; grid-template-columns: auto 8em 1fr; gap: 0.5rem; align-items: center; max-width: 56em;">
-                {{.CSRFField}}
-                <label style="font-size: 0.9em; color: #cbd5e1;">Agent</label>
-                <input type="text" name="agent_version" value="{{.Artifacts.AgentVersion}}" placeholder="0.43.0" style="padding: 0.3em 0.5em;">
-                <input type="text" name="agent_sha256" value="{{.Artifacts.AgentSHA256}}" placeholder="64-hex sha256 (blank = none)" style="padding: 0.3em 0.5em; font-family: monospace;">
-                <label style="font-size: 0.9em; color: #cbd5e1;">Golden</label>
-                <input type="text" name="golden_version" value="{{.Artifacts.GoldenVersion}}" placeholder="0.85.1" style="padding: 0.3em 0.5em;">
-                <input type="text" name="golden_sha256" value="{{.Artifacts.GoldenSHA256}}" placeholder="64-hex sha256 (blank = none)" style="padding: 0.3em 0.5em; font-family: monospace;">
-                <span></span><span></span>
-                <button class="btn btn-sm" type="submit" style="justify-self: start;">Save artifact manifest</button>
-            </form>
-        </div>
-
         <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 1rem;">
             <h2 style="margin: 0;">Customers</h2>
             <a href="/configs/new" class="btn">+ Add Customer</a>