feat(hub): OOB access health ingest + degraded alert (H1 Part 4)

store.GetHostOOBStates parses the agent oob heartbeat stanza. monitor/host_oob:
transition-based oob_degraded/oob_recovered warning (felhom-sshd down while the
operator peer is configured, OR config invalid) — proactive "can the operator get
in right now" signal; unconfigured OOB never alerts. Wired into the 60s sweep.
Non-hollow tests + transitions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/wg_operator.go

@@ -95,6 +95,16 @@ func (s *Store) SetOperatorOOBPeer(pubkey, assignedIP string) error {
 	return tx.Commit()
 }
 
+// oobOperatorSSHKeyKey is the hub_settings key for the fleet operator SSH public key (H1).
+const oobOperatorSSHKeyKey = "oob_operator_ssh_pubkey"
+
+// SetOOBOperatorSSHKey stores the operator's SSH PUBLIC key (an authorized_keys line, delivered to
+// every box via the desired-state so felhom-sshd honours the operator login). "" clears it.
+func (s *Store) SetOOBOperatorSSHKey(pubkey string) error { return s.setSetting(oobOperatorSSHKeyKey, pubkey) }
+
+// GetOOBOperatorSSHKey returns the operator SSH public key ("" if unset).
+func (s *Store) GetOOBOperatorSSHKey() string { return s.getSetting(oobOperatorSSHKeyKey) }
+
 func shortKey(k string) string {
 	if len(k) > 12 {
 		return k[:12] + "…"