Hub stage 5: manage each server from one console

Zones, Cache, Blocking, DNS Client, Settings, DHCP and Logs can now be
changed on one chosen server through the hub, with that server's admin
token. Operators manage cache and blocking; admins also zones, settings
and DHCP. Under "All servers", or on a server without an admin token,
the controls are disabled with a hint.

The hub refuses settings/set changes to a server's web service fields
and anything about users, SSO or LDAP; backup, restore, log and stats
deletion and admin/* stay refused. Non-admins get settings with secrets
blanked. Write params travel in the POST body, downloads pass through
with a single-use token, and the audit log names no values.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/ui/HubWriteHint.tsx

@@ -0,0 +1,16 @@
+import { CHOOSE_A_SERVER, type HubWrite } from '../lib/hub-write'
+
+/*
+The line under a server selector that says why the controls are switched off behind a hub:
+no server is chosen ("All servers"), or the hub holds no admin token for the one chosen.
+Nothing is drawn when the change is allowed, and nothing when the role is what says no (the
+controls then carry their own "Requires ..." tooltip).
+*/
+export function HubWriteHint({ write }: { write: HubWrite }) {
+  if (write.reason == null) return null
+  return (
+    <p className="m-0 text-xs text-muted-foreground" role="status">
+      {write.reason === CHOOSE_A_SERVER ? 'Choose a server to make changes. Changes are made on one server at a time.' : `${write.reason}, so this server is read only.`}
+    </p>
+  )
+}