hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

Host page "Operator Actions" card: run off-site backup now, run a check now
(fixed job list), stop / extend (1-30 days) a deletion countdown. POST
/hosts/{id}/operator-action validates against the CLOSED list before
storing (unknown -> 400, no row), stores operator_actions(id, customer_id,
action, arg, requested_at, requested_by, done_at, outcome, message), logs
who pressed (channel + address) and bumps the box's intent. The report ACK
lists pending rows as operator_actions until the box's
operator_action_results closes them (matched on id AND reporting
customer); each closed row becomes a hub-minted operator_action event
(stored, never dispatched). Unanswered after 24 h: expired. A customer
RESET cancels pending rows. Wire gate: new root + field-by-field mirror
(controller report.OperatorAction) — needs the controller commit first.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/web/hosts.go

@@ -865,6 +865,10 @@ func (s *Server) hostDetailData(host *store.Host, r *http.Request) map[string]in
 		// v0.46.0 Diagnostics: pending log pulls + received/blocked bundles (72 h TTL).
 		"LogBundles": s.hostLogBundleRows(host),
 		"CSRFToken":  s.getCSRFToken(r),
+		// Decision 185 (D1): the operator's closed list of actions for this host's controller.
+		"OperatorActions":      s.hostOperatorActionRows(host),
+		"OperatorJobNames":     store.OperatorJobNames(),
+		"OperatorExtendMaxDay": store.OperatorActionExtendMaxDays,
 		// v0.47.0 stale host removal: the danger-zone card renders ONLY for non-online
 		// hosts — an ONLINE host is never deletable (no override exists).
 		// R-30 slice 2 (D2): an online-by-report host whose box has been unreachable for