R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated

Unreleased; ships with tomorrow's hub release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/r304_older_package_event_test.go

@@ -0,0 +1,19 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// R-304 option C (decision 183): the controller's recovery_older_package must be accepted (or POST /event 400s — R-77)
+// and must reach only the operator. RED-PROOF: drop it from allowedEventTypes → "must be in allowedEventTypes".
+func TestR304_RecoveryOlderPackageIsAllowlistedAndOperatorOnly(t *testing.T) {
+	et := "recovery_older_package"
+	if !allowedEventTypes[et] {
+		t.Fatalf("%s must be in allowedEventTypes — the controller's push would 400", et)
+	}
+	if !notify.IsOperatorOnly(et) {
+		t.Fatalf("%s must be operator-only — reopening old history is the operator's (R-312)", et)
+	}
+}