hub (unreleased): the System page answers 'is anything wrong?' and 'is anything waiting for me?' first

Needs attention, Waiting for you (one card per kernel/Docker/Proxmox set the button may approve), a
7-column Boxes table whose rows open to every old value, and a closed Details (release ids, cancelled
approvals, ring-0 counts, floors, crash guard and root files, Approve now - which now asks first).
Same data, buttons, routes and CSRF field. No deploy. Screenshots in audits/hub-system-page-2026-10-10/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/11-os-updates.md

@@ -397,6 +397,11 @@ must never overlap a backup, a restore-test or a self-update.~~
   reboot needed / `kernel.panic` / oops / crash restarts / the guard, guest Debian / release / pending / restart needed,
   Docker engine / containerd / live-restore / release, the last leg — and above it the releases, what ring 0 runs, "Approve
   now" and "Approve Docker set". Colours are the alarm thresholds (decision 94). Hosts shows Proxmox / kernel too.
+  **Layout from 2026-10-10 (hub, unreleased at writing):** the page opens with „Needs attention" (one line per amber or
+  red box, the reasons in plain words, from the same colours) and „Waiting for you" (one card per kernel / Docker /
+  Proxmox set the button may approve now, with the version and the ring-0 evidence). The boxes follow in one narrow
+  table whose rows open to every value above; release ids, cancelled approvals, what ring 0 runs, the floors, the
+  crash guard and root files, and „Approve now" (which asks first) sit in a closed „Details". Same data and buttons.
 - **Household:** one line on the timeline in both languages, informal voice: what was updated and
   whether the box restarted. Telling households in advance that the box may restart at night is a
   **promise to users**. That is the operator's decision when the slow lane is built.