hub v0.26.0: pull-based config delivery + retire inbound GUI controls

config_version counter (bumped on every config save) advertised in the report
ACK; controller re-pulls + self-restarts on a change. Retire Trigger Update /
Push Config / Pull Config / Show Diff handlers+routes+buttons and the inbound
geo-notify (keep hub->Cloudflare geo removal). Setup command -> host-install;
delete dead customer.html + config_detail.html. Closes AUDIT-hub-gui F-S1/F-S4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

hub/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Felhom Hub — Changelog
 
+## v0.26.0 — pull-based config delivery + retire the inbound GUI controls (2026-06-30)
+
+Closes audit `documentation/audits/AUDIT-hub-gui-2026-06-30.md` F-S1/F-S4 + the dead-template findings,
+and replaces the never-inbound-violating "Push Config" with a pull-based config-refresh that rides the
+report ACK (companion controller change: felhom-controller v0.94.0).
+
+- **Config delivery is now pull-based (`internal/store/store.go`, `internal/api/handler.go`).** New
+  `customer_configs.config_version` column — a **stored counter** (NOT a hash of the rendered YAML;
+  `configgen` emits a fresh `web.session_secret` + timestamp every call, so a content hash would change
+  spuriously). `SaveCustomerConfig` **bumps it on every save** (new rows seed at 1, updates increment) —
+  the one path that changes the generated `controller.yaml` (identity + the `config_json` overrides). The
+  floor, block/unblock, and retrieval-password regen deliberately do NOT bump it. The report ACK
+  (`handleReport`) now advertises `config_version` beside `min_controller_version`/`latest_version`; the
+  controller compares it to its last-applied version and re-pulls + self-restarts on a change. Omitted for
+  report-only (no-config) customers, so an old controller is unaffected.
+- **Retired the five inbound (hub→box) controls** that violated the never-inbound posture
+  (`01-topology-and-trust.md:11`) and were broken behind the box's CF tunnel/NAT:
+  - **Trigger Update** — handler + route deleted; controller updates are agent-driven (the version floor).
+  - **Push Config** — handler + route deleted; replaced by the pull-based config-refresh above.
+  - **Pull Config** — handler + route deleted.
+  - **Show Diff** (`handleConfigDiff` + the `compareYAMLValues`/`flattenYAML`/`maskSensitive` helpers) —
+    deleted, along with the now-dead `ConfigSyncStatus`/`ConfigDiffCount` plumbing.
+  - **Geo-disable** — KEEPS its legitimate hub→Cloudflare WAF-rule removal (`RemoveGeoRules`); the
+    secondary inbound `notifyControllerGeoDisable` is deleted. After this, `grep client.Do
+    internal/web/` has **zero** ControllerURL targets (only Gitea registry/template fetches remain; the
+    ControllerURL is still shown as a display-only link).
+- **GUI staleness (F-S1) + dead templates:** the customer page's Setup Commands now show the Proxmox
+  Day-0 host bootstrap (`sudo ./felhom-host-install.sh --customer-id <id>`, passphrase at the no-echo
+  prompt) instead of the pre-Proxmox `docker-setup.sh`; Option 2 relabelled "Manual config fetch (debug
+  only)". Deleted the orphaned `customer.html` + `config_detail.html` (rendered by nothing; `/configs/{id}`
+  redirects to `/customers/{id}`).
+- **Audit doc (deferred line):** the GUI audit `documentation/audits/AUDIT-hub-gui-2026-06-30.md` (committed
+  `e51e03b`) is the grounding for the above; its F-S1/F-S4 + dead-template findings are now resolved. Open
+  follow-ups noted there remain: the Hosts page (F-M1), controller-side geo intent sync, and Show-Diff
+  could return later as a read-only-vs-reported view.
+- Tests: store `config_version` bump (create=1, edits increment, per-customer independent) + the
+  no-bump red-proof; ACK carries `config_version` and omits it for report-only customers + the no-bump
+  red-proof. `go build/vet/test ./...` green.
+
 ## v0.25.0 — per-storage worst-fill alerting (StorageFillChecker) (2026-06-30)
 
 Generalizes the host-root disk alert (v0.23.0) to ANY reported storage target — so a dedicated