Hub v0.158.0 code (built, NOT deployed): agent-only vouch, R-895 snapshot alarms, the hub's own 90-day access log (R-1140 A); installer --rotate-recovery-only (R-1141); 02/03/05/09 + break-glass

Hub: the R-120 golden guard judges only a CHANGED golden selection; offsite_snapshots_vanished /
_unexplained (operator-only, hub-origin) on the 07:10 listing; internal/accesslog writes path-only
lines to /data/access-log, 90 days. Installer: --rotate-recovery-only runs step 4b alone (rides
the next installer tag). 03: the orphan check runs after a failed backup (agent 6545ccc). 02: the
allow-list is empty, appdata_folders (controller v0.329.0). All red-proofed.

hub/internal/api/handler.go

@@ -16,6 +16,7 @@ import (
 	"sync"
 	"time"
 
+	"gitea.dooplex.hu/admin/felhom-hub/internal/accesslog"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/assets"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/claim"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/configgen"
@@ -195,6 +196,7 @@ func (h *Handler) checkAuthCustomer(r *http.Request) (customerID string, isGloba
 
 	// Check global key first
 	if h.apiKey != "" && subtle.ConstantTimeCompare([]byte(token), []byte(h.apiKey)) == 1 {
+		accesslog.Mark(r.Context(), "global") // R-1140: the KIND only, for the hub's access log
 		return "", true, true
 	}
 
@@ -203,6 +205,7 @@ func (h *Handler) checkAuthCustomer(r *http.Request) (customerID string, isGloba
 	if err != nil || cfg == nil {
 		return "", false, false
 	}
+	accesslog.Mark(r.Context(), "customer")
 	return cfg.CustomerID, false, true
 }
 
@@ -220,6 +223,7 @@ func (h *Handler) checkAuthHost(r *http.Request) (hostID, customerID string, isG
 
 	// Global key first (same constant-time compare as checkAuthCustomer).
 	if h.apiKey != "" && subtle.ConstantTimeCompare([]byte(token), []byte(h.apiKey)) == 1 {
+		accesslog.Mark(r.Context(), "global")
 		return "", "", true, true
 	}
 
@@ -227,6 +231,7 @@ func (h *Handler) checkAuthHost(r *http.Request) (hostID, customerID string, isG
 	if err != nil || host == nil {
 		return "", "", false, false
 	}
+	accesslog.Mark(r.Context(), "host")
 	return host.HostID, host.CustomerID, false, true
 }