fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kit-connect/bin/connect-daemon.sh

@@ -91,7 +91,7 @@ start_tailscale() {
         --accept-routes=false \
         --accept-dns=false 2>&1 | while read line; do log "tailscale: $line"; done
 
-    local ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
+    ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
     log "tailscale: connected — IP=${ts_ip}"
 }
 
@@ -152,33 +152,40 @@ start_tunnel() {
 
 # ── Hub registration — get assigned port ───────────────────────────
 register_with_hub() {
-    [ "$TUNNEL_REMOTE_PORT" != "0" ] && { log "hub: already registered (port=${TUNNEL_REMOTE_PORT})"; return 0; }
+    # Already registered — skip
+    if [ "$TUNNEL_REMOTE_PORT" != "0" ] && [ -n "$TUNNEL_REMOTE_PORT" ]; then
+        return 0
+    fi
 
     log "hub: registering device ${DEVICE_ID}..."
 
-    local resp=""
-    resp=$(curl -s --connect-timeout 10 \
+    # --max-time 15: total timeout (connect + response). SRM busybox curl needs this
+    # or the daemon hangs forever if the hub accepts the TCP connection but
+    # never sends the HTTP response.
+    resp=""
+    resp=$(curl -s --connect-timeout 10 --max-time 15 \
         "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
 
     if [ -z "$resp" ]; then
-        log "hub: unreachable — using last-known config"
+        log "hub: unreachable — will retry next cycle"
         return 1
     fi
 
-    # Parse JSON response (minimal — avoids jq dependency)
-    local port=""
-    port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
-    local tskey=""
-    tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
+    # Parse JSON response — POSIX-safe, no jq dependency
+    port=""
+    tskey=""
+    port=$(printf '%s' "$resp" | sed -n 's/.*"tunnel_port"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')
+    tskey=$(printf '%s' "$resp" | sed -n 's/.*"tailscale_auth_key"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
 
     if [ -n "$port" ] && [ "$port" != "0" ]; then
-        # Update config with assigned port
         sed -i "s/^TUNNEL_REMOTE_PORT=.*/TUNNEL_REMOTE_PORT=${port}/" "$CONF" 2>/dev/null
+        TUNNEL_REMOTE_PORT="$port"
         log "hub: assigned port ${port}"
     fi
 
     if [ -n "$tskey" ] && [ "$tskey" != "$TAILSCALE_AUTH_KEY" ]; then
         sed -i "s|^TAILSCALE_AUTH_KEY=.*|TAILSCALE_AUTH_KEY=${tskey}|" "$CONF" 2>/dev/null
+        TAILSCALE_AUTH_KEY="$tskey"
         log "hub: updated Tailscale key"
     fi
 }