fix: daemon hang, postinst mkdir, hub key authorization, boot persistence

SPK daemon fixes (x5925 testing feedback):
- register_with_hub: added --max-time 15 to prevent indefinite hang
- Removed bash 'local' keyword for busybox ash compatibility
- postinst: mkdir -p /usr/local/bin before copying Tailscale binaries
- postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug)
- Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed)

Hub security hardening:
- Added POST /api/authorize-key endpoint with device_id + pubkey
- Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>"
- No shell access allowed — only tunnel forwarding to assigned port
- Server.py updated with input validation on key format
- register.sh --authorize-key subcommand for secure key management

GL daemon: same --max-time fix applied for curl timeout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kit-connect/scripts/postinst

@@ -16,12 +16,16 @@ chmod +x "$PKG_DIR/wizard.sh" 2>/dev/null || true
 chmod 600 "$PKG_DIR/bin/connect_id_ed25519" 2>/dev/null || true
 
 # ── Install bundled Tailscale binaries if system doesn't have them ──
+# SRM doesn't have /usr/local/bin by default — create it first.
+mkdir -p /usr/local/bin
 if [ ! -f /usr/local/bin/tailscale ] && [ -f "$PKG_DIR/bin/tailscale" ]; then
-	log "Installing bundled Tailscale binaries..."
+	log "Installing bundled Tailscale binaries (1.98.9 ARM)..."
 	cp "$PKG_DIR/bin/tailscale" /usr/local/bin/tailscale
 	cp "$PKG_DIR/bin/tailscaled" /usr/local/bin/tailscaled
 	chmod +x /usr/local/bin/tailscale /usr/local/bin/tailscaled
 	log "Tailscale binaries installed to /usr/local/bin"
+elif [ -f /usr/local/bin/tailscale ]; then
+	log "Tailscale already present at /usr/local/bin/tailscale"
 fi
 
 # Run the Keylink IT setup wizard (non-interactive)