hub v0.41.0: OffsiteChecker (fill 90/95 + staleness >48h) + operator freeze lever (SLICE 4)

Sibling checker over the controller report's offsite object: quota-fill
warn/crit + the silently-stuck staleness detector (escrowed-only,
red-proofed; nil-safe on pre-v0.109 reports; same-second tie-guard).
SetOffsiteFrozen flips ONLY readonly on the exactly-1 labelled sub-account
(SSH preserved); Freeze/Unfreeze buttons — manual only, never automatic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/web/templates/customer_unified.html

@@ -45,6 +45,8 @@
             {{else if eq .Flash "updated"}}Configuration updated.
             {{else if eq .Flash "password_regenerated"}}Retrieval password regenerated.
             {{else if eq .Flash "offsite_reissued"}}Offsite credentials re-issued — a fresh one-time password is staged; the controller picks it up on its next config refresh.
+            {{else if eq .Flash "offsite_frozen"}}Offsite storage FROZEN (read-only) — new backups and prune will fail until unfrozen.
+            {{else if eq .Flash "offsite_unfrozen"}}Offsite storage unfrozen — read-write restored.
             {{else if eq .Flash "blocked"}}Customer blocked — hidden from Dashboard.
             {{else if eq .Flash "unblocked"}}Customer unblocked — visible on Dashboard again.
             {{end}}