fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hub/register.sh

@@ -1,19 +1,69 @@
 #!/bin/sh
-# busfleet-hub register.sh — Device registration endpoint
+# busfleet-hub register.sh — Device registration endpoint.
 # Called with DEVICE_ID as $1. Returns JSON on stdout.
 # Port pool: 2230-2299
+#
+# Also supports --authorize-key <pubkey> to authorize a device's tunnel key
+# with restrict,port-forwarding,permitlisten="<port>".
+
+set -e
+
+ACTION="${1:-}"
+DEVICE_ID="${2:-}"
 
-DEVICE_ID="${1:-unknown}"
 REGISTRY="/opt/busfleet-hub/port-registry.json"
+AUTHORIZED_KEYS="/home/node/.ssh/authorized_keys"
 PORT_POOL_START="${PORT_POOL_START:-2230}"
 PORT_POOL_END="${PORT_POOL_END:-2299}"
 TAILSCALE_AUTH_KEY="${TAILSCALE_AUTH_KEY:-tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV}"
 
 # Init registry if missing
-if [ ! -f "$REGISTRY" ]; then
-	echo '{}' > "$REGISTRY"
+[ ! -f "$REGISTRY" ] && echo '{}' > "$REGISTRY"
+
+if [ "$ACTION" = "--authorize-key" ]; then
+	# ── Authorize a device's public key for tunnel access ──────────
+	PUBKEY="${3:-}"
+	DEVICE_ID="${2:-}"
+	if [ -z "$PUBKEY" ] || [ -z "$DEVICE_ID" ]; then
+		echo '{"error": "usage: register.sh --authorize-key <device_id> <pubkey>"}'
+		exit 1
+	fi
+
+	# Look up the device's assigned port
+	ASSIGNED_PORT=$(python3 -c "
+import json
+with open('$REGISTRY') as f:
+    reg = json.load(f)
+print(reg.get('$DEVICE_ID', {}).get('tunnel_port', ''))
+" 2>/dev/null)
+
+	if [ -z "$ASSIGNED_PORT" ]; then
+		echo "{\"error\": \"device ${DEVICE_ID} not registered — register first\"}"
+		exit 1
+	fi
+
+	# Check if key already authorized (update if so)
+	if grep -q "kit-connect-${DEVICE_ID}" "$AUTHORIZED_KEYS" 2>/dev/null; then
+		# Remove old entry
+		sed -i "/kit-connect-${DEVICE_ID}/d" "$AUTHORIZED_KEYS" 2>/dev/null
+	fi
+
+	# Append with restrict options — only port-forwarding to the assigned port
+	RESTRICT="restrict,port-forwarding,permitlisten=\"${ASSIGNED_PORT}\""
+	echo "${RESTRICT} ${PUBKEY} kit-connect-${DEVICE_ID}" >> "$AUTHORIZED_KEYS"
+	chown node:node "$AUTHORIZED_KEYS" 2>/dev/null || true
+	chmod 600 "$AUTHORIZED_KEYS"
+
+	cat <<EOF
+{"device_id": "${DEVICE_ID}", "tunnel_port": ${ASSIGNED_PORT}, "key_authorized": true, "restrictions": "${RESTRICT}"}
+EOF
+	exit 0
 fi
 
+# ── Standard registration: assign port ─────────────────────────────
+DEVICE_ID="${ACTION}"   # First arg is device_id for registration
+[ -z "$DEVICE_ID" ] && DEVICE_ID="${1:-}"
+
 # Check if device already registered
 EXISTING_PORT=$(python3 -c "
 import json

hub/server.py

@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
-"""Busfleet Hub — minimal HTTP registration server for kit-connect devices.
+"""Busfleet Hub — registration server for kit-connect devices.
 
 Listens on :8080. Routes:
-  GET /api/register/<DEVICE_ID>  —  assign tunnel port, return JSON
-  GET /health                    —  health check
+  GET  /api/register/<DEVICE_ID>     — assign tunnel port, return JSON
+  POST /api/authorize-key             — authorize device's tunnel key
+  GET  /health                        — health check
 """
 
 import json
@@ -15,7 +16,7 @@ REGISTER_SH = "/opt/busfleet-hub/register.sh"
 
 
 class HubHandler(BaseHTTPRequestHandler):
-    """Handle hub registration requests."""
+    """Handle hub registration and key authorization requests."""
 
     def do_GET(self):
         # Route: /api/register/<DEVICE_ID>
@@ -45,6 +46,44 @@ class HubHandler(BaseHTTPRequestHandler):
 
         self.send_json_error(404, "Not found")
 
+    def do_POST(self):
+        # Route: /api/authorize-key
+        if self.path.startswith("/api/authorize-key"):
+            content_length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(content_length).decode() if content_length else "{}"
+
+            try:
+                data = json.loads(body)
+            except json.JSONDecodeError:
+                self.send_json_error(400, "Invalid JSON body")
+                return
+
+            device_id = data.get("device_id", "").strip()
+            pubkey = data.get("pubkey", "").strip()
+            if not device_id or not pubkey:
+                self.send_json_error(400, "Missing device_id or pubkey")
+                return
+
+            # Basic validation: key must look like an SSH public key
+            if not pubkey.startswith(("ssh-", "ecdsa-", "sk-")) or len(pubkey) < 80:
+                self.send_json_error(400, "Invalid SSH public key format")
+                return
+
+            try:
+                result = subprocess.run(
+                    [REGISTER_SH, "--authorize-key", device_id, pubkey],
+                    capture_output=True, text=True, timeout=15,
+                )
+                status = 200 if result.returncode == 0 else 500
+                self.send_json(status, result.stdout.strip())
+            except subprocess.TimeoutExpired:
+                self.send_json_error(504, "Key authorization timed out")
+            except Exception as exc:
+                self.send_json_error(500, str(exc))
+            return
+
+        self.send_json_error(404, "Not found")
+
     def send_json(self, status, body):
         """Send a JSON response."""
         self.send_response(status)