fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hub/server.py

@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
-"""Busfleet Hub — minimal HTTP registration server for kit-connect devices.
+"""Busfleet Hub — registration server for kit-connect devices.
 
 Listens on :8080. Routes:
-  GET /api/register/<DEVICE_ID>  —  assign tunnel port, return JSON
-  GET /health                    —  health check
+  GET  /api/register/<DEVICE_ID>     — assign tunnel port, return JSON
+  POST /api/authorize-key             — authorize device's tunnel key
+  GET  /health                        — health check
 """
 
 import json
@@ -15,7 +16,7 @@ REGISTER_SH = "/opt/busfleet-hub/register.sh"
 
 
 class HubHandler(BaseHTTPRequestHandler):
-    """Handle hub registration requests."""
+    """Handle hub registration and key authorization requests."""
 
     def do_GET(self):
         # Route: /api/register/<DEVICE_ID>
@@ -45,6 +46,44 @@ class HubHandler(BaseHTTPRequestHandler):
 
         self.send_json_error(404, "Not found")
 
+    def do_POST(self):
+        # Route: /api/authorize-key
+        if self.path.startswith("/api/authorize-key"):
+            content_length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(content_length).decode() if content_length else "{}"
+
+            try:
+                data = json.loads(body)
+            except json.JSONDecodeError:
+                self.send_json_error(400, "Invalid JSON body")
+                return
+
+            device_id = data.get("device_id", "").strip()
+            pubkey = data.get("pubkey", "").strip()
+            if not device_id or not pubkey:
+                self.send_json_error(400, "Missing device_id or pubkey")
+                return
+
+            # Basic validation: key must look like an SSH public key
+            if not pubkey.startswith(("ssh-", "ecdsa-", "sk-")) or len(pubkey) < 80:
+                self.send_json_error(400, "Invalid SSH public key format")
+                return
+
+            try:
+                result = subprocess.run(
+                    [REGISTER_SH, "--authorize-key", device_id, pubkey],
+                    capture_output=True, text=True, timeout=15,
+                )
+                status = 200 if result.returncode == 0 else 500
+                self.send_json(status, result.stdout.strip())
+            except subprocess.TimeoutExpired:
+                self.send_json_error(504, "Key authorization timed out")
+            except Exception as exc:
+                self.send_json_error(500, str(exc))
+            return
+
+        self.send_json_error(404, "Not found")
+
     def send_json(self, status, body):
         """Send a JSON response."""
         self.send_response(status)