docs: update CF token permissions for geo-restriction

Config form now shows Zone WAF:Edit requirement alongside DNS:Edit.
Hub README updated with permission note.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hub/internal/web/templates/config_form.html

@@ -76,7 +76,8 @@
                         <label for="cf_api_token">Cloudflare API Token</label>
                         <input type="text" id="cf_api_token" name="cf_api_token"
                             value="{{with .Overrides}}{{with index . "infrastructure"}}{{with index . "cf_api_token"}}{{.}}{{end}}{{end}}{{end}}"
-                            placeholder="For DNS-01 challenge">
+                            placeholder="DNS-01 + WAF permissions">
+                        <small class="form-hint">Szükséges jogosultságok: Zone DNS:Edit (ACME), Zone WAF:Edit (geo-korlátozás)</small>
                     </div>
                 </div>
             </details>