Multi-host phase 1: API tokens, auto TLS with pinned fingerprints, hub-side node manager + reverse proxy (WebSockets included), machine switcher in the rail, Machines page

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

PLAN.md

@@ -176,10 +176,23 @@ something long in one, switch away and back, refresh — it's all still there.
   the daemon's sampling clock; the chart window is always 300 samples, so 30 s at 100 ms
   and 10 min at 2 s. Still to do: persistent
   history (SQLite ring, e.g. 10 s × 7 days), SMART (`smartctl -j`), longer time ranges.
-- **Multi-host** — same binary as a headless *agent* on `grid` / Mac mini /
-  `wyse-5070-1`, `core`'s instance is the UI and fans out over mTLS. The rail grows a
-  host level at the top, exactly like Proxmox's datacenter → node tree. Design the
-  MVP URL space so `host` can be inserted later without breaking clients.
+- **Multi-host** — **Phase 1 shipped 2026-09-18** (`internal/nodes`, `internal/tlsauto`,
+  `MachineSwitcher.tsx`, `Machines.tsx`). One binary, hub and spoke: a host whose
+  `config.json` lists `nodes` is a hub; any other is a standalone node with its full UI.
+  Node side: `"tls": "auto"` makes a self-signed cert in the data dir and serves HTTPS;
+  `POST /api/tokens {password,name}` trades the login password for a long-lived bearer
+  token (SHA-256 stored in `tokens`), accepted by the auth middleware alongside the
+  cookie; `DELETE /api/tokens/{name}` revokes. Hub side: `POST /api/nodes {name,url,
+  password}` peeks the node's certificate (trust on first use, fingerprint pinned),
+  obtains a token named `hub:<hostname>`, stores `{name,url,fingerprint,token}`; a
+  15 s prober keeps each node's status; `/api/nodes/{name}/…` is a reverse proxy to the
+  node's `/api/…` (bearer swapped in, cookie and Origin stripped, streaming flush) that
+  carries WebSockets, so terminals, log tails and task output work remotely.
+  Frontend: `setMachine()` rewrites every `/api/…` path; the rail has a machine
+  switcher at the top and a Machines page to add/remove/open. Pages remount on switch;
+  terminals live on the node. First node: `grid`. Still to do: Phase 2 Datacenter
+  overview; Phase 3 `make deploy-remote` and update-from-hub; optional firewall rule
+  limiting a node's port to the hub.
 - **Auth hardening** — WebAuthn passkeys (phone Face ID), TOTP fallback, session
   list + revoke, optional NPM access list restricting to WireGuard/LAN.
 - **Files tab** — **shipped 2026-09-18** (`internal/files`, `Files.tsx`): browse from