feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

GET /api/v1/wait long-poll: the box holds an authed hanging GET; the hub
completes it the instant any operator intent bumps that customer's in-memory
generation, then the box fires its ordinary report and the ACK delivers
everything through the unchanged machinery. 240s hold with a 25s heartbeat
newline defeats the nginx 60s proxy_read_timeout with no ingress annotation;
WriteTimeout lifted per-connection via ResponseController.

- internal/intent: per-customer generation counter + waiter registry
  (Bump/Wait/Close), coalescing to latest, race-closer, in-memory by design.
  Red-proofs: counter-vs-queue + race-closer (run-fail-reverted).
- api/wait.go: the endpoint (per-customer only; global key 400; A cannot see B).
- web bumps after every intent write (fire-after-commit): config CRUD, claim
  resend, offsite re-issue/freeze, password regen, block/unblock, floors
  (global bumps all config-managed), controller log-tail + log-bundle.
- main.go: one intent hub shared by web+api; Close() before server.Shutdown.

Pairs with controller v0.140.0 (the long-poll client). Grounding:
documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md.

hub/internal/web/configs.go

@@ -561,6 +561,7 @@ func (s *Server) handleConfigCreate(w http.ResponseWriter, r *http.Request) {
 	}
 
 	s.logger.Printf("[INFO] Customer config created: %s", customerID)
+	s.bumpIntent(customerID) // Direction-2: wake a long-polling box in seconds
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=created", http.StatusSeeOther)
 }
 
@@ -629,6 +630,7 @@ func (s *Server) handleConfigUpdate(w http.ResponseWriter, r *http.Request, cust
 	}
 
 	s.logger.Printf("[INFO] Customer config updated: %s", customerID)
+	s.bumpIntent(customerID) // Direction-2: wake a long-polling box in seconds
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=updated#tab=edit", http.StatusSeeOther)
 }
 
@@ -652,6 +654,7 @@ func (s *Server) handleClaimResend(w http.ResponseWriter, r *http.Request, custo
 		return
 	}
 	s.logger.Printf("[INFO] claim code re-sent for %s (operator resend; generation rotated)", customerID)
+	s.bumpIntent(customerID) // Direction-2: the fresh claim hash rides the next report ACK
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=claim-resent#tab=setup", http.StatusSeeOther)
 }
 
@@ -696,6 +699,7 @@ func (s *Server) handleOffsiteReissue(w http.ResponseWriter, r *http.Request, cu
 		return
 	}
 	s.logger.Printf("[INFO] offsite credentials re-issued for %s (fresh one-time password stored; ConfigVersion bumped)", customerID)
+	s.bumpIntent(customerID) // Direction-2: wake the stuck box to re-pull + re-run the bridge
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=offsite_reissued#tab=edit", http.StatusSeeOther)
 }
 
@@ -735,6 +739,7 @@ func (s *Server) ReissueOffsiteForCustomer(ctx context.Context, customerID strin
 		return fmt.Errorf("offsite re-issue: config bump: %w", err)
 	}
 	s.logger.Printf("[INFO] offsite credentials re-issued for %s on re-enroll (fresh one-time password; ConfigVersion bumped)", customerID)
+	s.bumpIntent(customerID) // Direction-2: the fresh box's first wait wakes on this
 	return nil
 }
 
@@ -771,6 +776,7 @@ func (s *Server) handleOffsiteFreeze(w http.ResponseWriter, r *http.Request, cus
 		return
 	}
 	s.logger.Printf("[INFO] offsite frozen=%v (readonly) for %s (operator action)", frozen, customerID)
+	s.bumpIntent(customerID) // Direction-2: reflect the freeze state change to the box promptly
 	flash := "offsite_frozen"
 	if !frozen {
 		flash = "offsite_unfrozen"
@@ -787,6 +793,7 @@ func (s *Server) handleConfigDelete(w http.ResponseWriter, r *http.Request, cust
 	}
 
 	s.logger.Printf("[INFO] Customer config deleted: %s", customerID)
+	s.bumpIntent(customerID) // Direction-2: wake any still-holding wait so it completes promptly
 	http.Redirect(w, r, "/configs?flash=deleted", http.StatusSeeOther)
 }
 
@@ -832,6 +839,7 @@ func (s *Server) handleConfigRegenPassword(w http.ResponseWriter, r *http.Reques
 	}
 
 	s.logger.Printf("[INFO] Retrieval password regenerated for %s", customerID)
+	s.bumpIntent(customerID) // Direction-2: nudge the box promptly after a credential change
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=password_regenerated#tab=setup", http.StatusSeeOther)
 }
 
@@ -848,6 +856,7 @@ func (s *Server) handleBlockCustomer(w http.ResponseWriter, r *http.Request, cus
 		return
 	}
 	s.logger.Printf("[INFO] Customer blocked: %s", customerID)
+	s.bumpIntent(customerID) // Direction-2: deliver the blocked flag to the box in seconds
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=blocked#tab=edit", http.StatusSeeOther)
 }
 
@@ -864,6 +873,7 @@ func (s *Server) handleUnblockCustomer(w http.ResponseWriter, r *http.Request, c
 		return
 	}
 	s.logger.Printf("[INFO] Customer unblocked: %s", customerID)
+	s.bumpIntent(customerID) // Direction-2: clear the blocked flag on the box promptly
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=unblocked#tab=edit", http.StatusSeeOther)
 }
 
@@ -927,6 +937,13 @@ func (s *Server) handleSetGlobalFloor(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.logger.Printf("[INFO] Global controller-version floor set to %q", v)
+	// Direction-2: the global floor affects every config-managed customer — wake each long-polling
+	// box so the new floor lands in seconds (nil-safe; a customer with no held wait just advances).
+	if configs, cerr := s.store.ListCustomerConfigs(); cerr == nil {
+		for _, c := range configs {
+			s.bumpIntent(c.CustomerID)
+		}
+	}
 	http.Redirect(w, r, "/configuration?flash=floor_set", http.StatusSeeOther)
 }
 
@@ -1029,6 +1046,7 @@ func (s *Server) handleSetCustomerFloor(w http.ResponseWriter, r *http.Request,
 		return
 	}
 	s.logger.Printf("[INFO] Customer %s controller-version floor override set to %q", customerID, v)
+	s.bumpIntent(customerID) // Direction-2: deliver the new floor to the box in seconds
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=floor_set", http.StatusSeeOther)
 }