hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

Four small items, each a case where the hub already knew something and said
nothing. Green: build, vet, tests all pass.

(a) Self-bind link is minted automatically at customer creation AND at RESET
    completion (R-36 sub-item). The console banner tells the customer to open
    "az e-mailben kapott link"; until now that email existed only once the
    operator remembered the button, so the banner could point at something that
    did not exist — during the 2026-07-18 rehearsal the box waited ~11.7 min on
    exactly that. handleSelfBindLinkSend's body was extracted into a shared
    mintAndSendSelfBindLink core so the button and the auto-mint callers cannot
    drift apart on the honesty rules: F1 (no address -> mint nothing) and F2
    (send failed -> delete the token, never leave it live). The wrapper NEVER
    fails the operation it rides on — a create that provisioned Cloudflare,
    offsite and PBS must not 500 over a courtesy email.

    Gap found and closed while wiring it: PurgeCustomerResetDBState does NOT
    clear selfbind_tokens, so a link minted BEFORE a reset would have stayed
    live across it. A successful mint already replaces it (delete-then-insert,
    single-active); the skip paths would not have, so they now clear stale
    tokens too. Invariant: after auto-mint runs the only live link is one it
    just issued, or none.

(b) Post-RESET staleness banner (R-37). When a RESET COMPLETED after the newest
    report, every health figure on the page describes a lifecycle that no longer
    exists, and the page kept showing pre-RESET warnings as current. Narrow on
    purpose: an in-flight reset does not trigger it, and it clears itself when a
    report arrives. Ties resolve to STALE — SQLite timestamps are second-
    resolution and a same-second report almost certainly predates the reset;
    erring the other way would hide the banner exactly when it matters.

(c) Unprovisioned-offsite warning (R-36 interim). enabled==true with type=="" is
    a real, stable, silent state: provisioning is Save-triggered and the
    re-enroll auto-re-issue deliberately skips an unprovisioned target, so
    nothing self-heals it. Reuses the exact predicate the offsite re-issue
    handler already refuses on.

(d) pbsdr_reissued rendered an EMPTY flash box — the key had no template branch,
    so re-issuing PBS credentials showed a success box with no words (observed
    live 2026-07-18). Now describes what was staged plus the R-39 caveat:
    confirm `pvesm status` shows the entry active, because a converged agent can
    report `applied` while the storage still 401s.

New .flash-warn (amber, --warn tokens) for the deviation tier between success
and error — exception-color principle: only on deviation, never on a healthy
page.

Tests assert each banner is ABSENT in the nominal cases as well as present in
the deviating one — a banner that always renders is worse than none. Both
red-proofed: deleting the pbsdr_reissued branch reproduces the original empty
box; neutering the staleness predicate fails the banner assertion. New
read-only store accessor CountSelfBindTokens makes the single-active invariant
assertable.

NOT in this train: the R-39 hub-side generation-bump fix the pre-travel task
made conditional. Its condition was REFUTED (SetHostDesired bumps
unconditionally; applyPBSDR is idempotent as documented) — the real mechanism is
the agent's descriptor-hash convergence and needs its own spec.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

hub/internal/web/templates/customer_unified.html

@@ -48,6 +48,7 @@
             {{else if eq .Flash "updated"}}Configuration updated.
             {{else if eq .Flash "password_regenerated"}}Retrieval password regenerated.
             {{else if eq .Flash "offsite_reissued"}}Offsite credentials re-issued — a fresh one-time password is staged; the controller picks it up on its next config refresh.
+            {{else if eq .Flash "pbsdr_reissued"}}PBS DR credentials re-issued — a fresh one-time token secret is staged for the agent. Confirm it actually landed: the host's <code>pvesm status</code> must show the PBS entry <strong>active</strong>. A converged agent can report <code>applied</code> while the storage still authenticates 401 (R-39).
             {{else if eq .Flash "offsite_frozen"}}Offsite storage FROZEN (read-only) — new backups and prune will fail until unfrozen.
             {{else if eq .Flash "offsite_unfrozen"}}Offsite storage unfrozen — read-write restored.
             {{else if eq .Flash "blocked"}}Customer blocked — hidden from Dashboard.
@@ -69,6 +70,24 @@
         </div>
         {{end}}
 
+        {{if .StaleSinceReset}}
+        <div class="flash flash-warn">
+            <strong>No data since the RESET</strong> ({{.ResetAt}}) — „RESET óta nincs adat".
+            Every health figure below predates it and describes a lifecycle that no longer exists.
+            The box repopulates this page on its first report after re-onboarding.
+        </div>
+        {{end}}
+
+        {{if .OffsiteUnprovisioned}}
+        <div class="flash flash-warn">
+            <strong>Offsite is enabled but was never provisioned</strong> — no descriptor exists for
+            this customer, so nothing is being backed up offsite. Provisioning is <em>Save</em>-triggered:
+            open the Edit tab and press Save once to provision it, then verify on the Offsite page.
+            Re-enrollment will not fix this on its own — the auto-re-issue deliberately skips an
+            unprovisioned target. (R-36)
+        </div>
+        {{end}}
+
         <!-- Sticky summary strip: identity + liveness at a glance while any tab is scrolled.
              Values mirror fields already rendered in the panels — no extra handler data. -->
         <div class="summary-strip">

hub/internal/web/templates/style.css

@@ -677,6 +677,21 @@ code {
     border: 1px solid rgba(229,83,75,.3);
 }
 
+/* v0.67.0 — the deviation tier between success and error: a state that is not a failure but is
+   also not nominal, and that the operator must act on (post-RESET staleness R-37, enabled-but-
+   unprovisioned offsite R-36). Amber per the exception-color principle: it appears ONLY on
+   deviation, never on a healthy page. */
+.flash-warn {
+    background: var(--warn-dim);
+    color: var(--warn);
+    border: 1px solid rgba(224,169,62,.3);
+}
+.flash-warn strong { color: var(--text-1); }
+.flash-warn code {
+    font-family: var(--font-data);
+    font-size: .85em;
+}
+
 /* YAML Preview */
 .yaml-preview {
     background: var(--bg-0);