hub v0.14.0: passphrase-authed host enrollment (Day-0 option C)

New POST /api/v1/host-enroll (handleHostEnroll): X-Retrieval-Password authed,
body {customer_id} -> {host_id, api_key}. Mint-once-reuse (201 first, 200
reuse) so re-running the host-bootstrap never orphans a running agent's key;
auth checked before any mint. Backed by new Store.GetHostByCustomer
(ORDER BY updated_at DESC LIMIT 1, idx_hosts_customer).

GET /config/{id} and global-key POST /admin/hosts left untouched. Exact-match
route (path == "/host-enroll") to avoid the /hosts/ prefix collision.

Tests: host_enroll_test.go (mint/reuse/401-no-mint/404/400) + GetHostByCustomer
store test; companion red-proof verified always-mint fails the reuse assertion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TtXesNa2LGbMmE4DNL6SE7

hub/internal/store/store.go

@@ -1147,6 +1147,21 @@ func (s *Store) GetHost(hostID string) (*Host, error) {
 	return h, err
 }
 
+// GetHostByCustomer returns the customer's host, or nil (no error) if none exists.
+// Backs the passphrase-authed host-enroll mint-once-reuse path (Day-0 option C): on
+// the second enroll the existing credential is reused, not re-minted. A customer is
+// expected to have at most one host in the Day-0 model; if more than one ever exists,
+// the most-recently-updated wins (we never mint a duplicate on a reuse). Uses the
+// idx_hosts_customer index. Mirrors GetHostByAPIKey's nil-on-not-found contract.
+func (s *Store) GetHostByCustomer(customerID string) (*Host, error) {
+	h, err := scanHost(s.db.QueryRow(`SELECT `+hostSelectCols+
+		` FROM hosts WHERE customer_id = ? ORDER BY updated_at DESC LIMIT 1`, customerID).Scan)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	return h, err
+}
+
 // ListHosts returns all hosts (debug / host-domain views).
 func (s *Store) ListHosts() ([]Host, error) {
 	rows, err := s.db.Query(`SELECT ` + hostSelectCols + ` FROM hosts ORDER BY host_id`)