feat(deploy): server overlay and teamhub-deploy manifest for the VM

deploy/teamhub-deploy.json

@@ -17,9 +17,8 @@
   },
   "compose": {
     "subdir": ".",
-    "files": ["docker-compose.prod.yml"],
-    "env_file": ".env.prod",
-    "env_render_target": ".env.prod"
+    "files": ["docker-compose.yml", "docker-compose.server.yml"],
+    "env_render_target": ".env"
   },
   "health": {
     "base_url": "http://10.37.142.35:8050",

docker-compose.server.yml

@@ -0,0 +1,69 @@
+# Server overlay for the TeamHUB VM (Stage 5, debug window before the gateway).
+#
+# Usage (teamhub-deploy does this via deploy/teamhub-deploy.json):
+#   docker compose -f docker-compose.yml -f docker-compose.server.yml up -d --build
+#
+# Compared with the standalone dev compose this overlay:
+#   - moves every backing service onto the internal-only legacyhub_db network
+#     and strips their published host ports (postgres/minio/opensearch/qdrant/
+#     redis stay module-internal; OpenSearch keeps the security plugin disabled,
+#     which is acceptable ONLY while it is strictly internal);
+#   - publishes the api on ${LEGACYHUB_API_BIND:-127.0.0.1}:8050 — the server
+#     sets LEGACYHUB_API_BIND=<VM IP> so the teamhub-deploy health gate works;
+#     once the platform gateway fronts the module, switch to the federation
+#     overlay docker-compose.teamhub.yml (no host port at all);
+#   - attaches api and worker to the shared external teamhub_net for the
+#     dispatch bus (alias legacyhub-api) — teamhub_net is a regular bridge, so
+#     it also provides the egress needed for first-run HuggingFace downloads;
+#   - identity enforcement is env-driven: AUTH_REQUIRE_IDENTITY (set true on
+#     the server; machine paths keep X-API-Key auth).
+#
+# The shared network must exist first: docker network create teamhub_net
+
+networks:
+  teamhub_net:
+    external: true
+    name: teamhub_net
+
+services:
+  postgres:
+    networks: !override [legacyhub_db]
+    ports: !reset []
+    restart: always
+
+  minio:
+    networks: !override [legacyhub_db]
+    ports: !reset []
+    restart: always
+
+  opensearch:
+    networks: !override [legacyhub_db]
+    ports: !reset []
+    restart: always
+
+  qdrant:
+    networks: !override [legacyhub_db]
+    ports: !reset []
+    restart: always
+
+  redis:
+    networks: !override [legacyhub_db]
+    ports: !reset []
+    restart: always
+
+  api:
+    ports: !override
+      - "${LEGACYHUB_API_BIND:-127.0.0.1}:${API_HOST_PORT:-8050}:8000"
+    networks: !override
+      legacyhub_db: {}
+      teamhub_net:
+        aliases: [legacyhub-api]
+    environment:
+      AUTH_REQUIRE_IDENTITY: ${AUTH_REQUIRE_IDENTITY:-false}
+    restart: always
+
+  worker:
+    networks: !override
+      legacyhub_db: {}
+      teamhub_net: {}
+    restart: always