fix: audit gaps — GL local keyword, key authorization in wizards, register script parity

GL daemon: removed remaining 'local ts_ip' (busybox ash compat)
Synology wizard: auto-authorizes tunnel key via POST /api/authorize-key
GL wizard: same key authorization flow added
Synology: added connect-register.sh for parity with GL
syno-balance build.sh: removed deprecated checksum file (same lesson as kit-connect)

All four curl hubs (wizards + register scripts) now have --max-time 15.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

syno-balance/build.sh

@@ -2,22 +2,7 @@
 # build.sh — Assemble syno-balance SPK for Synology SRM (noarch)
 # Output: syno-balance-0.1-0001.spk
 # TEST BUILD — not for production.
-#
-# SPK structure (outer tar, UNCOMPRESSED):
-#   INFO
-#   PACKAGE_ICON.PNG         (64x64)
-#   PACKAGE_ICON_256.PNG     (256x256)
-#   scripts/
-#     postinst
-#     start-stop-status
-#     preinst
-#     preuninst
-#     postuninst
-#   conf/
-#     privilege
-#     resource
-#   package.tgz              (gzipped inner tar of bin/ + etc/)
-#   checksum                 (md5 of package.tgz)
+# Compatible: RT2600ac, RT6600ax, all ipq806x SRM routers.
 
 set -e
 
@@ -31,50 +16,32 @@ BUILD_DIR="/tmp/syno-balance-build-$$"
 
 echo "=== Building ${PKG_NAME}-${VERSION}.spk (TEST BUILD) ==="
 
-# Clean and create build staging directory
 rm -rf "$BUILD_DIR"
 mkdir -p "$BUILD_DIR"
 
-# ── 1. Create inner package.tgz (gzipped tar of bin/ + etc/) ──────────
-echo "  → Creating package.tgz"
-tar -czf "$BUILD_DIR/package.tgz" \
-    --format=ustar \
-    bin/ \
-    etc/
+# Inner package.tgz
+tar -czf "$BUILD_DIR/package.tgz" --format=ustar bin/ etc/
 
-# ── 2. Generate checksum ──────────────────────────────────────────────
-echo "  → Computing checksum"
-md5sum "$BUILD_DIR/package.tgz" | awk '{print $1}' > "$BUILD_DIR/checksum"
+# Stage outer SPK
+STAGE="$BUILD_DIR/stage"
+mkdir -p "$STAGE"
+cp INFO PACKAGE_ICON.PNG PACKAGE_ICON_256.PNG "$STAGE/"
+cp -r scripts "$STAGE/"
+mkdir -p "$STAGE/conf"
+cp conf/privilege conf/resource "$STAGE/conf/"
+cp "$BUILD_DIR/package.tgz" "$STAGE/"
 
-# ── 3. Assemble outer SPK (UNCOMPRESSED tar) ──────────────────────────
-echo "  → Assembling SPK"
-tar -cf "${OUTPUT}" \
-    --format=ustar \
-    -C "$SCRIPT_DIR" \
-    INFO \
-    PACKAGE_ICON.PNG \
-    PACKAGE_ICON_256.PNG \
-    scripts/ \
-    -C "$BUILD_DIR" \
-    package.tgz \
-    checksum
+# Assemble (no checksum — deprecated)
+tar -cf "${OUTPUT}" -C "$STAGE" --format=ustar \
+	INFO PACKAGE_ICON.PNG PACKAGE_ICON_256.PNG scripts conf package.tgz
 
-# SPK conf/ goes in the outer tar too
-tar -rf "${OUTPUT}" \
-    --format=ustar \
-    -C "$SCRIPT_DIR" \
-    conf/privilege \
-    conf/resource
-
-# ── 4. Verify ─────────────────────────────────────────────────────────
-echo "  → Verifying SPK contents"
+echo "  → SPK contents:"
 tar -tf "${OUTPUT}" | sort
 
-SIZE=$(stat -f%z "${OUTPUT}" 2>/dev/null || stat -c%s "${OUTPUT}" 2>/dev/null)
+SIZE=$(stat -c%s "${OUTPUT}" 2>/dev/null)
 echo ""
 echo "=== Build complete: ${OUTPUT} ==="
 echo "    Size: ${SIZE} bytes"
 echo "    MD5:  $(md5sum "${OUTPUT}" | awk '{print $1}')"
 
-# Cleanup
 rm -rf "$BUILD_DIR"