Hub: node signature before the WebSocket upgrade

The hub accepted a WebSocket from anyone on /node/v1, a path in the open
code, and replied with a hello nonce: one connection was enough to tell a
scanner what it had found. The agent now signs the upgrade request itself
(X-Node-Id, X-Node-Ts, X-Node-Sig; on first binding also the join secret
and its key), and the hub checks it before Accept. Without a valid
signature it answers Go's plain "404 page not found". Inside the socket
the protocol is unchanged, and the auth frame must come from the node that
signed the request.

Older agents send no signature. The hub lets them in while some node has
never connected the new way (nodes.preauth), logs them as outdated, and
closes that door by itself once every node is updated; HUB_LEGACY=on/off
overrides. The timestamp window is a day: node clocks drift, and the
headers travel inside pinned TLS. The agent treats a 404 at upgrade as a
rejection and backs off for a minute.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bNGYiDst62wH3ZGTRPFLJ

internal/cli/cli.go

@@ -185,6 +185,8 @@ func New() *CLI {
 				{"SUB_HOST", env("SUB_HOST", "")},
 				// Приём нод (core): без NODE_PORT хаб выключен. LOCAL_NODE=off — core без своего VPN.
 				{"NODE_PORT", env("NODE_PORT", "")},
+				// Хаб: пускать ли агентов без подписи до апгрейда (on/off; пусто — пока не обновлены все).
+				{"HUB_LEGACY", env("HUB_LEGACY", "")},
 				// IP ретрансляторов (старый сервер после переноса): им — доверие к заголовку PROXY.
 				{"RELAY_FROM", env("RELAY_FROM", "")},
 				// Reverse-proxy перед панелью (кроме loopback): от них — X-Forwarded-For / X-Real-IP.