hub v0.70.1: the ghost customer's Delete button must exist (Danger-zone render gate split)

hub/internal/web/templates/customer_unified.html

@@ -811,13 +811,20 @@
             document.getElementById('cust-reset-form-' + cid).submit();
         }
         </script>
+        {{end}}
 
         <!-- Danger zone (v0.48.0 edit-a): the Block/Delete forms relocated verbatim from the
-             Customer Info header — endpoints and confirm() handlers unchanged. -->
+             Customer Info header — endpoints and confirm() handlers unchanged.
+             v0.70.1: gated on .Deletable, NOT .HasConfig — a GHOST customer (config gone, hosts or
+             report/telemetry residue remain) must render the Delete button, or the whole v0.70.0
+             ghost-delete path is dead UI (found live on demo-vm-felhom). RESET stays HasConfig-gated
+             above (identity-preserving re-onboarding — a ghost has no identity to preserve). -->
+        {{if .Deletable}}
         <section class="card">
             <h2>Danger zone</h2>
-            <p class="text-muted">Blocking hides the customer from the Dashboard (reports are still accepted). <strong>Delete customer</strong> is the full offboarding teardown (v0.69.0): it deletes the host(s), then RESETs the customer (offsite repository destroyed, PBS credentials revoked, tunnel and zone removed), then purges the customer record and all escrow ciphertext — including the <strong>retained recovery-key custody</strong> for this customer's hosts. This is the one true purge point; host deletion only demotes custody, never destroys it. Three acknowledgements and the typed customer-id are required. For identity-preserving re-onboarding use <em>Ügyfél-visszaállítás (RESET)</em> above instead.</p>
+            <p class="text-muted">{{if not .HasConfig}}<strong style="color: var(--warn);">Ghost customer</strong> — the configuration record is already gone; Delete is the applicable action. {{end}}Blocking hides the customer from the Dashboard (reports are still accepted). <strong>Delete customer</strong> is the full offboarding teardown (v0.69.0): it deletes the host(s), then RESETs the customer (offsite repository destroyed, PBS credentials revoked, tunnel and zone removed), then purges the customer record and all escrow ciphertext — including the <strong>retained recovery-key custody</strong> for this customer's hosts. This is the one true purge point; host deletion only demotes custody, never destroys it. Three acknowledgements and the typed customer-id are required. For identity-preserving re-onboarding use <em>Ügyfél-visszaállítás (RESET)</em> above instead.</p>
             <div style="display: flex; gap: 0.5rem; flex-wrap: wrap; margin-top: 0.5rem;">
+                {{if .HasConfig}}{{/* v0.70.1: blocking gates dashboard visibility of a CONFIGURED customer — meaningless for a ghost */}}
                 {{if .IsBlocked}}
                 <form method="POST" action="/customers/{{.CustomerID}}/unblock" style="display:inline">
                     {{.CSRFField}}
@@ -829,6 +836,7 @@
                     <button type="submit" class="btn btn-outline btn-sm" data-confirm="Block this customer? They will be hidden from the Dashboard.">Block</button>
                 </form>
                 {{end}}
+                {{end}}
                 <button type="button" class="btn btn-danger btn-sm" onclick="customerDeleteOpen('{{.CustomerID}}')">Delete customer&hellip;</button>
             </div>