fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

gl-kit-connect/files/usr/sbin/connect-daemon.sh

@@ -144,7 +144,7 @@ register_with_hub() {
 
 	log "hub: registering device ${DEVICE_ID}..."
 
-	resp=$(curl -s --connect-timeout 10 \
+	resp=$(curl -s --connect-timeout 10 --max-time 15 \
 		"http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
 
 	[ -z "$resp" ] && { warn "hub: unreachable"; return 1; }