fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kit-connect/bin/x5925-boot.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+# x5925-boot.sh — Boot persistence stopgap for x5925
+# Brings up Tailscale + reverse SSH tunnel on reboot.
+# Runs as a Synology scheduled trigger-on-boot task.
+# Once the SPK daemon is fixed, this script becomes redundant.
+
+LOG_TAG="kit-connect-boot"
+log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
+
+log "=== Boot persistence for x5925 ==="
+log "device=x5925 hub=162.243.83.36 port=2230"
+
+# ── 1. Tailscale ────────────────────────────────────────────────
+TAILSCALE_BIN="/usr/local/bin/tailscale"
+TAILSCALED_BIN="/usr/local/bin/tailscaled"
+TAILSCALE_STATEDIR="/var/packages/Tailscale/var/state"
+TAILSCALE_SOCKET="/var/packages/Tailscale/var/run/tailscaled.sock"
+AUTH_KEY="tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV"
+
+if [ -x "$TAILSCALED_BIN" ]; then
+	mkdir -p "$TAILSCALE_STATEDIR" "$(dirname "$TAILSCALE_SOCKET")"
+
+	# Check if already running
+	if "$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" status >/dev/null 2>&1; then
+		log "tailscale: already connected — $("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo no-ip)"
+	else
+		log "tailscale: starting tailscaled..."
+		/usr/bin/setsid "$TAILSCALED_BIN" \
+			--statedir="$TAILSCALE_STATEDIR" \
+			--tun=userspace-networking \
+			--socket="$TAILSCALE_SOCKET" \
+			>/dev/null 2>&1 &
+		sleep 4
+
+		log "tailscale: authenticating..."
+		"$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" up \
+			--auth-key "$AUTH_KEY" \
+			--hostname x5925 \
+			--accept-routes=false \
+			--accept-dns=false 2>&1 | while read -r line; do log "tailscale: $line"; done
+
+		ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
+		log "tailscale: connected — IP=${ts_ip}"
+	fi
+else
+	log "tailscale: binaries not found at $TAILSCALED_BIN"
+fi
+
+# ── 2. Reverse SSH tunnel ───────────────────────────────────────
+TUNNEL_KEY="/var/packages/kit-connect/target/bin/connect_id_ed25519"
+TUNNEL_HOST="162.243.83.36"
+TUNNEL_USER="node"
+TUNNEL_PORT="2230"
+LOCAL_SSH_PORT="2223"
+
+if [ -f "$TUNNEL_KEY" ]; then
+	chmod 600 "$TUNNEL_KEY"
+
+	# Check if tunnel already exists
+	if pgrep -f "ssh.*-R.*${TUNNEL_PORT}" >/dev/null 2>&1; then
+		log "tunnel: already active on port ${TUNNEL_PORT}"
+	else
+		log "tunnel: opening R:0.0.0.0:${TUNNEL_PORT} -> 127.0.0.1:${LOCAL_SSH_PORT}"
+
+		ssh \
+			-o StrictHostKeyChecking=no \
+			-o UserKnownHostsFile=/dev/null \
+			-o ServerAliveInterval=15 \
+			-o ServerAliveCountMax=3 \
+			-o ExitOnForwardFailure=yes \
+			-o BatchMode=yes \
+			-p 22 -N \
+			-R "0.0.0.0:${TUNNEL_PORT}:127.0.0.1:${LOCAL_SSH_PORT}" \
+			-i "$TUNNEL_KEY" \
+			"${TUNNEL_USER}@${TUNNEL_HOST}" \
+			2>/var/packages/kit-connect/target/var/boot-tunnel.err &
+
+		TUNNEL_PID=$!
+		log "tunnel: SSH PID=${TUNNEL_PID}"
+		echo "$TUNNEL_PID" > /var/packages/kit-connect/target/var/boot-tunnel.pid
+	fi
+else
+	log "tunnel: key not found at $TUNNEL_KEY"
+fi
+
+log "=== Boot persistence complete ==="