hub v0.41.0: OffsiteChecker (fill 90/95 + staleness >48h) + operator freeze lever (SLICE 4)

Sibling checker over the controller report's offsite object: quota-fill
warn/crit + the silently-stuck staleness detector (escrowed-only,
red-proofed; nil-safe on pre-v0.109 reports; same-second tie-guard).
SetOffsiteFrozen flips ONLY readonly on the exactly-1 labelled sub-account
(SSH preserved); Freeze/Unfreeze buttons — manual only, never automatic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/templates/config_form.html

@@ -141,6 +141,18 @@
                     formaction="/configs/{{$.Config.CustomerID}}/offsite-reissue" formmethod="POST"
                     onclick="return confirm('Re-issue the offsite credentials?\n\nThe box password is reset and a fresh one-time password is staged for the controller. Guests with a working installed key are unaffected (key-auth-first); a stuck fresh guest picks the new password up on its next config refresh.')">
                     Re-issue offsite credentials</button>
+                {{if eq (index . "type") "shared"}}
+                <!-- SLICE 4: operator freeze lever (readonly on the sub-account) — MANUAL only, never
+                     automatic: freezing also blocks prune, the customer's only way down from over-quota. -->
+                <button type="submit" class="btn btn-outline" style="margin-top:.5rem"
+                    formaction="/configs/{{$.Config.CustomerID}}/offsite-freeze" formmethod="POST"
+                    onclick="return confirm('Freeze the offsite storage (read-only)?\n\nNew backups AND prune will fail until unfrozen — use for runaway usage only.')">
+                    Freeze offsite (read-only)</button>
+                <button type="submit" class="btn btn-outline" name="unfreeze" value="1" style="margin-top:.5rem"
+                    formaction="/configs/{{$.Config.CustomerID}}/offsite-freeze" formmethod="POST"
+                    onclick="return confirm('Unfreeze the offsite storage (read-write again)?')">
+                    Unfreeze offsite</button>
+                {{end}}
                 {{end}}{{end}}{{end}}
             </details>