feat(hub): Direction-2 immediate-sync wait channel (v0.58.0)

GET /api/v1/wait long-poll: the box holds an authed hanging GET; the hub
completes it the instant any operator intent bumps that customer's in-memory
generation, then the box fires its ordinary report and the ACK delivers
everything through the unchanged machinery. 240s hold with a 25s heartbeat
newline defeats the nginx 60s proxy_read_timeout with no ingress annotation;
WriteTimeout lifted per-connection via ResponseController.

- internal/intent: per-customer generation counter + waiter registry
  (Bump/Wait/Close), coalescing to latest, race-closer, in-memory by design.
  Red-proofs: counter-vs-queue + race-closer (run-fail-reverted).
- api/wait.go: the endpoint (per-customer only; global key 400; A cannot see B).
- web bumps after every intent write (fire-after-commit): config CRUD, claim
  resend, offsite re-issue/freeze, password regen, block/unblock, floors
  (global bumps all config-managed), controller log-tail + log-bundle.
- main.go: one intent hub shared by web+api; Close() before server.Shutdown.

Pairs with controller v0.140.0 (the long-poll client). Grounding:
documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md.

hub/internal/web/server.go

@@ -18,6 +18,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-hub/internal/assets"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/claim"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/gitea"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/intent"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/offsite"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/semver"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
@@ -66,6 +67,11 @@ type Server struct {
 	offsite         *offsite.Provisioner // optional; enables Hetzner offsite provisioning (SLICE 1)
 	tenantsync      tenancyProvisioner   // optional; enables PBS DR tier provisioning (web/pbsdr.go)
 	claimEngine     *claim.Engine        // optional; enables the customer-claim resend button (v0.50.0)
+	// intentHub (v0.58.0, Direction-2 immediate-sync) is Bumped by every operator-intent handler
+	// (config save/delete, claim resend, offsite re-issue/freeze, floor, block/unblock, log pull)
+	// so a box long-polling GET /api/v1/wait wakes in seconds. Shared with the API handler. nil =
+	// no immediacy (bumps are no-ops; the 15-min cycle still reconciles).
+	intentHub *intent.Hub
 
 	sessions   map[string]*hubSession
 	sessionsMu sync.RWMutex
@@ -170,6 +176,19 @@ func (s *Server) SetOffsiteProvisioner(p *offsite.Provisioner) { s.offsite = p }
 // SetClaimEngine wires the customer-claim code engine for the Setup-tab resend button (v0.50.0).
 func (s *Server) SetClaimEngine(e *claim.Engine) { s.claimEngine = e }
 
+// SetIntentHub wires the operator-intent notifier (v0.58.0). Every intent handler bumps it via
+// s.bumpIntent; nil-safe (bumps become no-ops).
+func (s *Server) SetIntentHub(hub *intent.Hub) { s.intentHub = hub }
+
+// bumpIntent advances the customer's wait generation so a box long-polling GET /api/v1/wait wakes
+// immediately. nil-safe. Call AFTER the successful store write (mirror the report.Trigger
+// fire-after-commit rule — never on an error path).
+func (s *Server) bumpIntent(customerID string) {
+	if s.intentHub != nil {
+		s.intentHub.Bump(customerID)
+	}
+}
+
 // SetGiteaClient enables the Day-0 artifact version dropdowns (optional). Without it the artifact form
 // degrades to manual text entry.
 func (s *Server) SetGiteaClient(c *gitea.Client) {