0.3.0:0

Update to upstream Spaces 0.3.0 and refresh bundled images (subs v0.1.2c,
certrelay v0.2.8, nacho v1.0.0b). Add Create/Show Registry API Keys for
registry-server, remove Configure Subspaces and SUBS_PUBLISH_REQUIRE_FINALIZED,
and align README/instructions with the new tags.

Co-authored-by: Cursor <cursoragent@cursor.com>

startos/i18n/dictionaries/default.ts

@@ -289,16 +289,25 @@ const dict = {
     205,
   'Subspaces Prover Auth credentials saved. Auth is currently DISABLED — enable it with "Enable Subspaces Prover Auth" to enforce these credentials.':
     206,
-  'Configure Subspaces': 207,
-  'Set user-tunable subs options. Saving restarts the service so the subs daemon picks up the new environment.':
-    208,
-  'Require Finalized Publish': 209,
-  'When on, subs blocks certificate publish until commitments are finalized (150 confirmations). Maps to SUBS_PUBLISH_REQUIRE_FINALIZED in the subs daemon environment. Off by default.':
-    210,
-  'Subspaces configuration saved. SUBS_PUBLISH_REQUIRE_FINALIZED is enabled; the service is restarting.':
-    211,
-  'Subspaces configuration saved. SUBS_PUBLISH_REQUIRE_FINALIZED is disabled; the service is restarting.':
-    212,
+  'Create Registry API Keys': 213,
+  'Generate (or rotate) REGISTRY_API_KEY and SUBSD_API_KEY for the embedded registry-server. Both are required and must differ. Put SUBSD_API_KEY in subs Settings → Registry Server → Auth Token. REGISTRY_API_KEY is for intake clients calling POST /register. Saving restarts the service so registry-server picks up the new keys.':
+    214,
+  'Registry API keys saved. Paste SUBSD_API_KEY into subs Settings → Registry Server → Auth Token, then click Test. Use REGISTRY_API_KEY as the Bearer token for POST /register clients. The service is restarting so registry-server picks up the new keys.':
+    215,
+  REGISTRY_API_KEY: 216,
+  SUBSD_API_KEY: 217,
+  'Bearer secret for intake/POST /register clients.': 218,
+  'Paste into subs Settings → Registry Server → Auth Token (subs↔registry channel).':
+    219,
+  'Show Registry API Keys': 220,
+  'Display the stored REGISTRY_API_KEY and SUBSD_API_KEY used by registry-server. Returns blanks if Create Registry API Keys has not been run yet.':
+    221,
+  'Paste SUBSD_API_KEY into subs Settings → Registry Server → Auth Token. Use REGISTRY_API_KEY as the Bearer token for POST /register clients.':
+    222,
+  'No valid registry API keys are stored yet. Run Create Registry API Keys first (both keys must be non-empty and different).':
+    223,
+  'Subspaces registry-server requires REGISTRY_API_KEY and SUBSD_API_KEY before it can start':
+    224,
 } as const
 
 /**