Show whether a feeder is registered vs. claimed in the UI (#59)

* feat(claim): surface real account-claim status in the UI

Adds GET /api/claim/status, backed by a single-flight, identity-keyed cache over a read-only `apl-feed claim status` probe, and replaces the claim activity panel's secret-presence guess with the real registered-vs-claimed verdict, a freshness stamp, and a Check now button.

* feat(claim): add account-claim status indicator to the Identity card

A colored dot + label in the Identity card header reflects the /api/claim/status verdict — green claimed, blue registered, orange not registered, red action needed, grey unknown — refreshed on dashboard load and the status-snapshot poll.

* fix(dashboard): order the readsb tile before airplanes-feed

readsb is the local decoder every other 1090 tile depends on; surfacing it first matches the data path (decode → feed → mlat).

Author: d4rken

cmd/devserver/main.go

@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"github.com/airplanes-live/image-webconfig/internal/auth"
+	"github.com/airplanes-live/image-webconfig/internal/claimstatus"
 	"github.com/airplanes-live/image-webconfig/internal/devfakes"
 	"github.com/airplanes-live/image-webconfig/internal/feedenv"
 	"github.com/airplanes-live/image-webconfig/internal/identity"
@@ -110,6 +111,16 @@ func main() {
 		status.WithWifi(devfakes.NewWifiProbe(state)),
 	)
 
+	// Claim-status probe routed through the same fake runner; the dev-stub
+	// argv lands in devfakes.claimStatusFeed, which reports a verdict
+	// coherent with the simulated identity (unregistered → unclaimed once
+	// the Register button materialises a secret).
+	claimStatusProber := claimstatus.Prober{
+		Runner: devfakes.Runner(state, priv),
+		Argv:   []string{"dev-stub", "apl-feed", "claim", "status", "--json"},
+	}
+	claimStatusCache := claimstatus.NewCache(claimStatusProber.Probe, nil)
+
 	handler := server.New(server.Deps{
 		Version:          "dev",
 		Store:            auth.NewPasswordStore(state.Paths.PasswordHash),
@@ -120,6 +131,7 @@ func main() {
 		Identity:         identity.NewReader(idPaths),
 		FeedEnv:          &feedenv.Reader{Path: state.Paths.FeedEnv},
 		Status:           statusReader,
+		ClaimStatus:      claimStatusCache,
 		Logs:             logs.NewStreamer(devfakes.StreamRunner(state)),
 		Schema:           schema,
 		Runner:           devfakes.Runner(state, priv),

cmd/webconfig/main.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/airplanes-live/image-webconfig/internal/auth"
+	"github.com/airplanes-live/image-webconfig/internal/claimstatus"
 	wexec "github.com/airplanes-live/image-webconfig/internal/exec"
 	"github.com/airplanes-live/image-webconfig/internal/feedenv"
 	"github.com/airplanes-live/image-webconfig/internal/hardware"
@@ -140,6 +141,11 @@ func main() {
 	}
 	loadCancel()
 
+	// Account-claim status: read-only, unprivileged `apl-feed claim status
+	// --json` behind a single-flight, identity-keyed cache.
+	claimStatusProber := claimstatus.Prober{Runner: wexec.RealRunner, Argv: claimstatus.DefaultArgv}
+	claimStatusCache := claimstatus.NewCache(claimStatusProber.Probe, nil)
+
 	effectiveVersion := resolveVersion()
 	srv := &http.Server{
 		Addr: *listen,
@@ -161,9 +167,10 @@ func main() {
 				)),
 				status.WithWifi(wifi.NewSignalReader("/usr/bin/nmcli", nil)),
 			),
-			Logs:       logs.NewStreamer(nil),
-			Schema:     cache,
-			Privileged: priv,
+			Logs:        logs.NewStreamer(nil),
+			Schema:      cache,
+			ClaimStatus: claimStatusCache,
+			Privileged:  priv,
 		}),
 		ReadHeaderTimeout: 5 * time.Second,
 		ReadTimeout:       15 * time.Second,