fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hub/register.sh

@@ -1,19 +1,69 @@
 #!/bin/sh
-# busfleet-hub register.sh — Device registration endpoint
+# busfleet-hub register.sh — Device registration endpoint.
 # Called with DEVICE_ID as $1. Returns JSON on stdout.
 # Port pool: 2230-2299
+#
+# Also supports --authorize-key <pubkey> to authorize a device's tunnel key
+# with restrict,port-forwarding,permitlisten="<port>".
+
+set -e
+
+ACTION="${1:-}"
+DEVICE_ID="${2:-}"
 
-DEVICE_ID="${1:-unknown}"
 REGISTRY="/opt/busfleet-hub/port-registry.json"
+AUTHORIZED_KEYS="/home/node/.ssh/authorized_keys"
 PORT_POOL_START="${PORT_POOL_START:-2230}"
 PORT_POOL_END="${PORT_POOL_END:-2299}"
 TAILSCALE_AUTH_KEY="${TAILSCALE_AUTH_KEY:-tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV}"
 
 # Init registry if missing
-if [ ! -f "$REGISTRY" ]; then
-	echo '{}' > "$REGISTRY"
+[ ! -f "$REGISTRY" ] && echo '{}' > "$REGISTRY"
+
+if [ "$ACTION" = "--authorize-key" ]; then
+	# ── Authorize a device's public key for tunnel access ──────────
+	PUBKEY="${3:-}"
+	DEVICE_ID="${2:-}"
+	if [ -z "$PUBKEY" ] || [ -z "$DEVICE_ID" ]; then
+		echo '{"error": "usage: register.sh --authorize-key <device_id> <pubkey>"}'
+		exit 1
+	fi
+
+	# Look up the device's assigned port
+	ASSIGNED_PORT=$(python3 -c "
+import json
+with open('$REGISTRY') as f:
+    reg = json.load(f)
+print(reg.get('$DEVICE_ID', {}).get('tunnel_port', ''))
+" 2>/dev/null)
+
+	if [ -z "$ASSIGNED_PORT" ]; then
+		echo "{\"error\": \"device ${DEVICE_ID} not registered — register first\"}"
+		exit 1
+	fi
+
+	# Check if key already authorized (update if so)
+	if grep -q "kit-connect-${DEVICE_ID}" "$AUTHORIZED_KEYS" 2>/dev/null; then
+		# Remove old entry
+		sed -i "/kit-connect-${DEVICE_ID}/d" "$AUTHORIZED_KEYS" 2>/dev/null
+	fi
+
+	# Append with restrict options — only port-forwarding to the assigned port
+	RESTRICT="restrict,port-forwarding,permitlisten=\"${ASSIGNED_PORT}\""
+	echo "${RESTRICT} ${PUBKEY} kit-connect-${DEVICE_ID}" >> "$AUTHORIZED_KEYS"
+	chown node:node "$AUTHORIZED_KEYS" 2>/dev/null || true
+	chmod 600 "$AUTHORIZED_KEYS"
+
+	cat <<EOF
+{"device_id": "${DEVICE_ID}", "tunnel_port": ${ASSIGNED_PORT}, "key_authorized": true, "restrictions": "${RESTRICT}"}
+EOF
+	exit 0
 fi
 
+# ── Standard registration: assign port ─────────────────────────────
+DEVICE_ID="${ACTION}"   # First arg is device_id for registration
+[ -z "$DEVICE_ID" ] && DEVICE_ID="${1:-}"
+
 # Check if device already registered
 EXISTING_PORT=$(python3 -c "
 import json