deploy(hub): v0.35.0 — OOB operator access (TASK H1)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Felhom Hub — Changelog
 
+## v0.35.0 — OOB operator access: operator peer + oob_peer_ip/oob_operator_ssh_key + OOB health alert (TASK H1) (2026-07-05)
+
+The hub half of the merged E1+H1 operator-SSH-access feature (agent half = felhom-agent v0.72.0).
+
+- **Operator OOB peer** (`store/wg_operator.go`): the fleet operator peer as an UNBOUND wg_peers row
+  (host_id '', note operator-oob) at an EXPLICIT /32 (so the endpoint's static forward chain can
+  hardcode it); validated in-subnet/not-reserved/not-taken; last-write-wins rotation. It rides
+  ListWGPeers → peersync pushes it to the endpoint. `PUT/GET /admin/wg/operator-peer` (global key);
+  the PUT also takes an optional `ssh_pubkey` (the operator authorized_keys line, hub_settings) and
+  bumps EVERY host's generation.
+- **Desired-state** (`api/wg.go` mergeWireguard): when an operator peer exists, the served wireguard
+  block carries `oob_peer_ip` (rendered into the box's AllowedIPs — survives self-heal [OF-1]) and
+  `oob_operator_ssh_key` (agent writes felhom-sshd's authorized_keys). Absent → byte-identical.
+- **OOB health** (`monitor/host_oob.go`): ingests the agent's `oob` heartbeat stanza and raises a
+  transition-based `oob_degraded`/`oob_recovered` warning (felhom-sshd down while the operator peer
+  is configured, OR config invalid) — the proactive "can the operator get in right now" signal.
+
 ## v0.34.1 — mgmt_plane_healed alerts on the FIRST auto-heal (TASK G1 fix) (2026-07-05)
 
 The mgmt-plane checker seeded a heal marker silently on first observation (copied from HostLeafChecker's

manifests/hub.yaml

@@ -126,7 +126,7 @@ spec:
     spec:
       containers:
         - name: hub
-          image: gitea.dooplex.hu/admin/felhom-hub:0.34.1
+          image: gitea.dooplex.hu/admin/felhom-hub:0.35.0
           ports:
             - containerPort: 8080
               name: http