docs: S1 shipped — hub v0.32.0/0.32.1 CHANGELOG, peersync v1.0.0, 06 S1 status, CONTEXT, REPORT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,22 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-04 — S1 SHIPPED: offsite endpoint live + hub peer-sync (hub v0.32.1)** — the doc-06
+  roadmap's first slice, done-criterion met live. Peer-sync design point RESOLVED: **hub pushes
+  over SSH** to a forced-command `felhom-peersync` script (pull rejected: weakens immediate
+  revocation; HTTPS API rejected: new binary + third public port). Endpoint = the dev
+  `felhom-hetzner` box, provisioned by the NEW runbook `documentation/runbooks/offsite-endpoint.md`
+  (WG on **443/udp**, subnet 10.77.0.0/24, PBS datastore `felhom-offsite` at `/srv/pbs-felhom`,
+  nftables drop-all + wg0-only 8007, `ep0.felhom.eu` grey-cloud). Hub: `wg_endpoints`/`wg_peers` +
+  /32 allocator + `/admin/wg/*` (global-key, pubkey-in-body) + `internal/wgsync` (FixedHostKey pin
+  + **pinned-type HostKeyAlgorithms — live-caught bug**: multi-hostkey sshd presented ECDSA vs the
+  ed25519 pin; fixed v0.32.1 + regression test) + full-list declarative reconciler (5-min drift
+  repair). Live: add/remove→wg show, malformed→state-untouched, reboot→persist+converge, client
+  tunnel via ep0:443→PBS login page, public 8007 closed. INCIDENT handled: first WG server key
+  leaked via `wg show dump` into the session log → rotated immediately (warning now in the
+  runbook). OPERATOR follow-up: **fix the AAAA record** (currently `…7aa1::`, must be `…7aa1::1`).
+  Next: **S2** (hub schema host-join + `wireguard` block on WireDesiredState + box-facing
+  registration + UI).
 - **2026-07-03 — OFFSITE-CONNECTIVITY DESIGN-OF-RECORD WRITTEN (architecture Part 06)** —
   `documentation/architecture/06-offsite-connectivity.md`: records the six settled decisions
   (plain WG / host-side agent-managed `wg-felhom` as the agent-managed-unit PILOT / one shared