Hub stage 5: manage each server from one console

Zones, Cache, Blocking, DNS Client, Settings, DHCP and Logs can now be
changed on one chosen server through the hub, with that server's admin
token. Operators manage cache and blocking; admins also zones, settings
and DHCP. Under "All servers", or on a server without an admin token,
the controls are disabled with a hint.

The hub refuses settings/set changes to a server's web service fields
and anything about users, SSO or LDAP; backup, restore, log and stats
deletion and admin/* stay refused. Non-admins get settings with secrets
blanked. Write params travel in the POST body, downloads pass through
with a single-use token, and the audit log names no values.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/apps-write.test.ts

@@ -40,8 +40,12 @@ function fake(): Promise<Fake> {
         const url = new URL(req.url ?? '/', 'http://fake')
         const apiPath = url.pathname.replace(/^\/api\//, '')
         const token = url.searchParams.get('token') ?? ''
-        const name = url.searchParams.get('name') ?? ''
-        f.calls.push({ path: apiPath, token, method: req.method ?? '', query: url.searchParams, body: Buffer.concat(chunks), contentType: String(req.headers['content-type'] ?? '') })
+        const contentType = String(req.headers['content-type'] ?? '')
+        // Technitium reads query or form alike; `query` here is both (`token` is the only one the hub leaves in the URL).
+        const query = new URLSearchParams(url.searchParams)
+        if (contentType.includes('application/x-www-form-urlencoded')) for (const [k, v] of new URLSearchParams(Buffer.concat(chunks).toString('utf8'))) query.set(k, v)
+        const name = query.get('name') ?? ''
+        f.calls.push({ path: apiPath, token, method: req.method ?? '', query, body: Buffer.concat(chunks), contentType })
         res.setHeader('content-type', 'application/json')
         const ok = (response: unknown = {}) => res.end(JSON.stringify({ status: 'ok', response }))
         const error = (m: string) => res.end(JSON.stringify({ status: 'error', errorMessage: m }))
@@ -58,7 +62,7 @@ function fake(): Promise<Fake> {
             return f.apps[name] ? ok({ config: f.apps[name].config }) : error('not found')
           case 'apps/downloadAndInstall':
           case 'apps/downloadAndUpdate': {
-            const entry = f.store.find((s) => s.name === name && s.url === url.searchParams.get('url'))
+            const entry = f.store.find((s) => s.name === name && s.url === query.get('url'))
             if (!entry) return error('not in store')
             f.apps[name] = { version: entry.version, config: f.apps[name]?.config ?? null }
             return ok()