hub v0.120.0: app_update_undone/held reach the household, per app, in its language

Allowlisted, not operator-only, seeded for new households and added
once (add-only) to every existing enabled_events row. mail.event entries
in hu and en name the app from details.stack_name. Per-app cooldown on
both the operator and the household leg.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/handler.go

@@ -2013,6 +2013,13 @@ var allowedEventTypes = map[string]bool{
 	// `backup_run_digest_event_test.go` pins the pair.
 	"backup_run_failures": true,
 
+	// v0.120.0 (`09` §3 decision 15): an app update the box UNDID by itself (warning) and one that ended
+	// HELD — the undo failed too, or the update held for any reason (error). BOTH reach the household
+	// (one mail per app per outcome — per-app cooldown, notify.perAppCustomerCooldownEvents) and the
+	// operator; both carry a Hungarian AND English `mail.event.*` entry, never the raw-English fallback.
+	"app_update_undone": true,
+	"app_update_held":   true,
+
 	// Controller-pushed events
 	"controller_started":      true,
 	"claim_lockout":           true, // v0.50.0 — claim/reset code brute-force lockout tripped