docs+manifest: hub v0.49.0 — Edit tab merge train (CHANGELOG, REUSE rows, CONTEXT, GitOps bump)

Version note: the task spec targeted 0.48.0 but that tag had already shipped
(app_start_failed); published tags are never re-pointed → this train is 0.49.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TZc5w5jDhFLv6qDC32KN5v

CONTEXT.md

@@ -3,6 +3,21 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-12 — HUB v0.49.0 SHIPPED: Edit tab merge (edit-a) + scoped auto-refresh + riders**
+  (CHANGELOG v0.49.0; commits `e740147` → `2e03de1` → `1d94b1a` + docs/manifest). The standalone
+  customer edit page merged into the customer page's **Edit** tab (renamed from Settings): shared
+  `config_form_body` sub-template + `configFormData` builder (REUSE.md rows added), Block/Delete
+  relocated to a danger-zone card, header cleaned, `GET /configs/{id}/edit` → 302 `#tab=edit`,
+  post-action redirects anchored to their tab, `settings→edit` legacy-hash alias. Update handler
+  gained server-side required-field validation (error path preserves SUBMITTED values —
+  red-proofed). The 60s auto-refresh is now scoped: fires only on live tabs
+  (`data-live-tabs="overview,applications,events,host"`) and never while a form is dirty; muted
+  `(paused)` hint. Riders: `/style.css?v={{hubVersion}}` cache-bust on every template (closes the
+  v0.47.0 max-age=3600 gotcha) + the CLAUDE.md `git add -A` ban codified. **NOTE: the task spec
+  said v0.48.0, but v0.48.0 (app_start_failed) had already shipped — published tags are never
+  re-pointed, so this train is v0.49.0.** Out of scope (observed, not done): type-to-confirm for
+  customer delete (still `confirm()`, relocated as-is); the workspace-root `E:\git\CLAUDE.md` and
+  other repos' CLAUDE.md files still carry `git add -A` snippets — flag for their own sessions.
 - **2026-07-12 — Day-0 VM DRILL COMPLETE (auto-confirm FIRST LIVE FIRING): full arc proven on a
   fresh nested-PVE box** — appliance Day-0 → floor-at-first-report → ceremony → **auto-confirm
   pending→escrowed in ~7.5 min, zero clicks** → offsite backup + restore round-trip. Two HIGH gaps: