hub v0.25.0: per-storage worst-fill alerting (StorageFillChecker)

Generalizes host_disk to any reported storage target (dump/backup volume, data drive,
thin pool, PBS). Per-(host,target) state, born/persistent, natural critical severity,
distinct storage_fill_* events; excludes the root-backed builtin (host_disk owns root).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

hub/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Felhom Hub — Changelog
 
+## v0.25.0 — per-storage worst-fill alerting (StorageFillChecker) (2026-06-30)
+
+Generalizes the host-root disk alert (v0.23.0) to ANY reported storage target — so a dedicated
+dump/backup volume, data drive, lvmthin pool, or PBS datastore filling toward failure pages the operator
+with the storage named, even when host root itself is fine.
+
+- **`internal/monitor/storage_fill.go` (NEW) — `StorageFillChecker`.** A per-target mirror of
+  `HostDiskChecker` on the same 60s sweep: born/persistent (already-breached `(host,target)` keys left
+  UNSEEDED → first `Check` emits), escalation-only emit, recovery re-arm, the dispatcher's 1h cooldown.
+  State is keyed per **(host, target)** so targets alert independently. Emits distinct
+  `storage_fill_warning` / `storage_fill_critical` at the **natural `critical` severity** (exercises the
+  v0.24.0 dispatcher fix with a second real caller). Default thresholds 90/95, hub-config overridable
+  (`alerting.storage_fill_warn_percent` / `_crit_percent`), independent of the host-root thresholds.
+- **Root excluded (no double-alert):** the host root-backed builtin (`Type=="local"`, or a target mounted
+  at `/`) is skipped — `HostDiskChecker` owns root. So a root-backed vzdump dump is one alert (from
+  host_disk), and storage_fill uniquely covers OFF-root storage.
+- **`internal/store/store.go`:** `GetHostStorageTargets()` + `HostStorageTargetRow` — parses
+  `report_json.storage_targets[]` of each host's latest report (percent = `used_fraction`×100); modeled on
+  `GetHostDiskUsage`, no denorm column / migration.
+- **`internal/notify/templates.go` + `internal/api/handler.go`:** Hungarian templates + allowlist entries
+  for `storage_fill_warning` / `storage_fill_critical`.
+- **`cmd/hub/main.go`:** register `storageFillChecker` on the 60s tick beside `HostDiskChecker`.
+- Tests: per-target bands (independent warn/escalate/recover/re-arm), **born/persistent companion red-proof**
+  (a seed-all model stays silent on the born-breach), **root-exclusion companion** (without the exclusion a
+  root target IS in the critical band — the exclusion is what suppresses the double-alert), severity
+  `critical`, and the store parse. `go build/vet/test ./...` green.
+
 ## v0.24.0 — dispatcher routes `critical` severity (+ nil-prefs crash guard) (2026-06-30)
 
 NAS Part A2's "Part 0": close the dispatcher's silent drop of `critical`-severity events.