hub: customer-claim password arc parts 1+2 — code engine, emails, ACK, configgen bake, UI (v0.50.0)

Closes DRILL-day0-vm F-4 hub-side: per-customer claim state (customer_claims,
bcrypt-only custody), the claim engine (issue at real config retrieve = Day-0
bake; first-report issue for live boxes; resend rotates generation; reset
rate-limited 3/day), three Hungarian emails via the dispatcher, report-ACK
claim object {code_hash, generation, issued_at} + set-only claimed ingest,
web.claim_code_* baked into generated controller.yaml, Setup-tab status chip
+ resend button, POST /api/v1/claim/reset-request (self-scoped), claim_lockout
event allowlisted. 13 new tests; full repo green.

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

hub/internal/notify/dispatcher.go

@@ -224,3 +224,24 @@ func isEventEnabled(enabledEvents []string, eventType string) bool {
 	}
 	return false
 }
+
+// SendClaimEmail delivers a customer-claim arc email (claim / reset / claimed confirmation) to
+// the REGISTERED customer address — the claim.Mailer implementation. Every send result is
+// logged + recorded in notification_log; the code itself never is (rule: plaintext exists only
+// inside the send).
+func (d *Dispatcher) SendClaimEmail(kind, customerID, email, domain, code string) error {
+	if d.resendAPIKey == "" {
+		d.logger.Printf("[ERROR] claim %s email for %s NOT sent: no Resend API key configured", kind, customerID)
+		return fmt.Errorf("notify: no resend api key")
+	}
+	subject, body := FormatClaimEmail(kind, customerID, domain, code)
+	eventType := "claim_" + kind
+	if err := d.sendEmailFn(email, subject, body); err != nil {
+		d.logger.Printf("[ERROR] claim %s email to customer %s failed: %v", kind, customerID, err)
+		d.store.LogNotification(customerID, eventType, "info", subject, "failed", err.Error(), "customer")
+		return err
+	}
+	d.logger.Printf("[INFO] claim %s email sent to the registered address of %s", kind, customerID)
+	d.store.LogNotification(customerID, eventType, "info", subject, "sent", "", "customer")
+	return nil
+}