docs: update CF token permissions for geo-restriction

Config form now shows Zone WAF:Edit requirement alongside DNS:Edit.
Hub README updated with permission note.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hub/README.md

@@ -188,7 +188,7 @@ Synchronizer-token CSRF protection on all browser POST/DELETE/PATCH operations:
   - **Managed + reporting:** Full view — config info, system metrics, storage, containers, backup status, events timeline (last 50, severity filter), credentials, setup commands, YAML preview, controller update, notifications (with channel column), history
   - **Managed + no reports yet:** Config info, credentials, setup commands, "Waiting for first report" indicator
   - **Manual (report-only):** System metrics, storage, containers, backup, with "Create Config" button to convert to managed
-- **Config Form (`/configs/new`, `/configs/{id}/edit`)** — Create/edit customer configurations with identity, infrastructure tokens, and monitoring overrides. Legacy Monitoring UUIDs section collapsed by default with deprecation notice
+- **Config Form (`/configs/new`, `/configs/{id}/edit`)** — Create/edit customer configurations with identity, infrastructure tokens, and monitoring overrides. Legacy Monitoring UUIDs section collapsed by default with deprecation notice. CF API token requires **Zone DNS:Edit** (ACME) and **Zone WAF:Edit** (geo-restriction) permissions.
 
 ### Customer States
 

hub/internal/web/templates/config_form.html

@@ -76,7 +76,8 @@
                         <label for="cf_api_token">Cloudflare API Token</label>
                         <input type="text" id="cf_api_token" name="cf_api_token"
                             value="{{with .Overrides}}{{with index . "infrastructure"}}{{with index . "cf_api_token"}}{{.}}{{end}}{{end}}{{end}}"
-                            placeholder="For DNS-01 challenge">
+                            placeholder="DNS-01 + WAF permissions">
+                        <small class="form-hint">Szükséges jogosultságok: Zone DNS:Edit (ACME), Zone WAF:Edit (geo-korlátozás)</small>
                     </div>
                 </div>
             </details>