fix: audit gaps — GL local keyword, key authorization in wizards, register script parity

GL daemon: removed remaining 'local ts_ip' (busybox ash compat)
Synology wizard: auto-authorizes tunnel key via POST /api/authorize-key
GL wizard: same key authorization flow added
Synology: added connect-register.sh for parity with GL
syno-balance build.sh: removed deprecated checksum file (same lesson as kit-connect)

All four curl hubs (wizards + register scripts) now have --max-time 15.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kit-connect/wizard.sh

@@ -86,7 +86,7 @@ ok "Config written to ${CONF}"
 # ── Step 4: Register with hub ──────────────────────────────────
 step "Registering with fleet hub (${HUB_HOST}:${HUB_PORT})..."
 
-resp=$(curl -s --connect-timeout 10 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
+resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
 
 if [ -z "$resp" ]; then
 	warn "Hub unreachable — will retry on next daemon start"
@@ -105,6 +105,18 @@ else
 		sed -i "s|^TAILSCALE_AUTH_KEY=.*|TAILSCALE_AUTH_KEY=${tskey}|" "$CONF" 2>/dev/null
 		ok "Tailscale key configured"
 	fi
+
+	# ── Authorize tunnel key with hub ──────────────────────
+	if [ -n "$port" ] && [ "$port" != "0" ] && [ -f /var/packages/kit-connect/target/bin/connect_id_ed25519.pub ]; then
+		PUBKEY=$(awk '{print $1" "$2}' /var/packages/kit-connect/target/bin/connect_id_ed25519.pub 2>/dev/null)
+		if [ -n "$PUBKEY" ]; then
+			curl -s --connect-timeout 10 --max-time 15 \
+				-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
+				-H "Content-Type: application/json" \
+				-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
+				>/dev/null 2>&1 && ok "Tunnel key authorized (restrict, port ${port})" || true
+		fi
+	fi
 fi
 
 # ── Step 5: Dashboard server ───────────────────────────────────