scripts+manifests: S1 felhom-peersync.sh v1.0.0 + hub wg-endpoint-ssh deploy surface

Peersync script: validate-first (jq contract check before ANY state change),
head-file + generated-peers conf model, syncconf-from-tmp then atomic mv (live
conf never diverges in the failure direction), zero-peer payload valid (wipe).
hub.yaml: 0.32.0 image + WG_ENDPOINT_SSH_* env + optional Secret mount so the
pod starts before the runbook's step-6 Secret exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

manifests/hub.yaml

@@ -126,7 +126,7 @@ spec:
     spec:
       containers:
         - name: hub
-          image: gitea.dooplex.hu/admin/felhom-hub:0.31.0
+          image: gitea.dooplex.hu/admin/felhom-hub:0.32.0
           ports:
             - containerPort: 8080
               name: http
@@ -154,6 +154,23 @@ spec:
                 secretKeyRef:
                   name: gitea-creds
                   key: password
+            # S1 offsite connectivity: the WG peer-sync push channel (doc 06 §5 + runbook
+            # offsite-endpoint.md). Addr is dev-phase literal (the throwaway endpoint); the SSH
+            # private key + (non-secret) pinned host key come from Secret/wg-endpoint-ssh,
+            # created out-of-band in runbook step 6 — optional so the pod starts before it
+            # exists (the hub logs peer-sync disabled until then).
+            - name: WG_ENDPOINT_SSH_ADDR
+              value: "167.233.158.164:22"
+            - name: WG_ENDPOINT_SSH_USER
+              value: "felhom-peersync"
+            - name: WG_ENDPOINT_SSH_KEY_FILE
+              value: "/etc/hub-secrets/wg-endpoint-ssh/key"
+            - name: WG_ENDPOINT_SSH_HOSTKEY
+              valueFrom:
+                secretKeyRef:
+                  name: wg-endpoint-ssh
+                  key: hostkey
+                  optional: true
           resources:
             requests:
               memory: "64Mi"
@@ -166,6 +183,9 @@ spec:
               mountPath: /data
             - name: config
               mountPath: /etc/felhom-hub
+            - name: wg-endpoint-ssh
+              mountPath: /etc/hub-secrets/wg-endpoint-ssh
+              readOnly: true
           livenessProbe:
             httpGet:
               path: /healthz
@@ -187,6 +207,14 @@ spec:
         - name: config
           configMap:
             name: hub-config
+        - name: wg-endpoint-ssh
+          secret:
+            secretName: wg-endpoint-ssh
+            optional: true
+            items:
+              - key: key
+                path: key
+                mode: 0400
 
 # =============================================================================
 # SERVICE