hub v0.28.0 + host-install v1.2.0: settings→Configuration, online install, vmid auto-detect

Part A (hub): move the global-floor + Day-0-artifacts cards from the Customers
page to the Configuration tab; routes → /configuration/{global-floor,artifacts};
redirects + flashes to /configuration. Customers page back to list + Add.

Part B: online setup command on the customer page (download-then-run, passphrase
at prompt, not templated); serve /scripts/ from the website (sparse-checkout +
nginx location) so felhom.eu/scripts/felhom-host-install.sh resolves; script
passphrase prompt reads < /dev/tty (works for pipe-to-bash too).

Part C (script): --vmid auto-detect — default 9201 in use + no --force → pick the
next free id from pct+qm and confirm; explicit --vmid stays die-unless-force.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/web/templates/customer_unified.html

@@ -389,13 +389,25 @@
                 The retrieval passphrase is entered at the no-echo prompt — never on the command line.
             </p>
 
-            <h3>Option 1: Host install (recommended)</h3>
+            <h3>Option 1: Online install (recommended)</h3>
+            <p class="text-muted" style="margin: 0 0 0.4rem; font-size: 0.8rem;">
+                Fetches the script over TLS from felhom.eu, then runs it. Download-then-run (not
+                <code>curl | sudo bash</code>) so you can inspect the script before executing it — the
+                right default for a sovereignty product. The passphrase is entered at the no-echo prompt.
+            </p>
+            <div class="credential-box">
+                <code id="cmd-online">curl -fsSL https://felhom.eu/scripts/felhom-host-install.sh -o felhom-host-install.sh \
+  && sudo bash felhom-host-install.sh --customer-id {{.CustomerID}}</code>
+                <button type="button" class="copy-btn" onclick="copyText('cmd-online')" title="Copy">&#x2398;</button>
+            </div>
+
+            <h3 style="margin-top: 1rem;">Option 2: Local install (script already on host)</h3>
             <div class="credential-box">
                 <code id="cmd-setup">sudo ./felhom-host-install.sh --customer-id {{.CustomerID}}</code>
                 <button type="button" class="copy-btn" onclick="copyText('cmd-setup')" title="Copy">&#x2398;</button>
             </div>
 
-            <h3 style="margin-top: 1rem;">Option 2: Manual config fetch (debug only)</h3>
+            <h3 style="margin-top: 1rem;">Option 3: Manual config fetch (debug only)</h3>
             <p class="text-muted" style="margin: 0 0 0.4rem; font-size: 0.8rem;">The same payload the controller pulls itself — for inspection, not normal provisioning.</p>
             <div class="credential-box">
                 <code id="cmd-curl">curl -fsSL https://hub.felhom.eu/api/v1/config/{{.CustomerID}} -H "X-Retrieval-Password: {{.Config.RetrievalPassword}}" -o controller.yaml</code>