hub v0.46.0: observability pass — per-box log pulls, bundle custody, 72h TTL + secret gate

log_bundle_requests + log_bundles store (gzip, newest-3, 72h TTL purged on the
60s sweep); SaveLogBundle secret gate fail-closed (blocked flag row, no payload;
REDACTED/checksums pass). Report ACK gains controller_log_requested + ingests
controller_log_tail; heartbeat envelope gains log_tail_requested + ingests
log_tail (consume-once on arrival; pre-0.83 agents stay visibly pending). Host
detail Diagnostics section: request buttons (controller/agent), state rows with
honest latency hints, View/Download endpoint. Red-proofs: gate disabled and
clear-on-arrival removed both FAIL their tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/hosts.go

@@ -329,6 +329,9 @@ func (s *Server) handleHostDetail(w http.ResponseWriter, r *http.Request, hostID
 		"StorageTargets":    storageTargets,
 		"DRPresent":         drBundle != nil,
 		"EscrowPresent":     escrow != nil,
+		// v0.46.0 Diagnostics: pending log pulls + received/blocked bundles (72 h TTL).
+		"LogBundles": s.hostLogBundleRows(host),
+		"CSRFToken":  s.getCSRFToken(r),
 	}
 	if err := s.templates.ExecuteTemplate(w, "host_detail.html", data); err != nil {
 		s.logger.Printf("[ERROR] host_detail.html template: %v", err)