fix: audit gaps — GL local keyword, key authorization in wizards, register script parity

GL daemon: removed remaining 'local ts_ip' (busybox ash compat)
Synology wizard: auto-authorizes tunnel key via POST /api/authorize-key
GL wizard: same key authorization flow added
Synology: added connect-register.sh for parity with GL
syno-balance build.sh: removed deprecated checksum file (same lesson as kit-connect)

All four curl hubs (wizards + register scripts) now have --max-time 15.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

gl-kit-connect/files/usr/sbin/connect-wizard.sh

@@ -107,7 +107,7 @@ step "Registering with fleet hub (${HUB_HOST}:${HUB_PORT})..."
 REG_FLAG=""
 [ "$FORCE" = "1" ] && REG_FLAG="--force"
 
-resp=$(curl -s --connect-timeout 10 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
+resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
 
 if [ -z "$resp" ]; then
 	warn "Hub unreachable — will retry on next daemon start"
@@ -127,6 +127,18 @@ else
 		uci commit kitconnect
 		ok "Tailscale key configured"
 	fi
+
+		# Authorize tunnel key with hub (restrict,port-forwarding)
+		if [ -n "$port" ] && [ "$port" != "0" ] && [ -f /etc/kitconnect/connect_id_ed25519.pub ]; then
+			PUBKEY=$(awk '{print $1" "$2}' /etc/kitconnect/connect_id_ed25519.pub 2>/dev/null)
+			if [ -n "$PUBKEY" ]; then
+				curl -s --connect-timeout 10 --max-time 15 \
+					-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
+					-H "Content-Type: application/json" \
+					-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
+					>/dev/null 2>&1 && ok "Tunnel key authorized (restrict, port ${port})" || true
+			fi
+		fi
 fi
 
 # ── Step 6: Enable & start service ─────────────────────────────