hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

Needs attention, Waiting for you (one card per kernel/Docker/Proxmox set the button may approve), a
7-column Boxes table whose rows open to every old value, and a closed Details (release ids, cancelled
approvals, ring-0 counts, floors, crash guard and root files, Approve now - which now asks first).
Same data, buttons, routes and CSRF field. No deploy. Screenshots in audits/hub-system-page-2026-10-10/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/05-hub-architecture.md

@@ -152,6 +152,11 @@ box's agent against the vouched one ("0.142.0 → 0.145.0 (since …)", amber, r
 vouched agent for 7 days raises `agent_behind` (warning, operator-only; `OS_ALARM_AGENT_BEHIND_AFTER`; the clock starts
 when the hub first sees the box behind). `[DESIGN — CC 2026-10-05, operator may reverse; `09` decision 119]`
 
+**The System page's layout (2026-10-10).** It answers „is anything wrong?" (Needs attention) and „is anything waiting
+for me?" (Waiting for you) first, then the boxes in one narrow table that opens per box, and folds release ids,
+cancelled approvals, ring-0 package counts, the floors, the crash guard and root files into a closed „Details". The
+page's content list is `11` §5.7; the contract that nothing was dropped is `web/system_layout_test.go`.
+
 ## 6. Authorization — signed-op queue + editing flow
 
 Implements Part 4's gate on the hub side. The hub holds **no signing key**.