feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -13,8 +13,11 @@ POSTGRES_PASSWORD=legacyhub
 MINIO_ENDPOINT=minio:9000
 MINIO_ACCESS_KEY=legacyhub
 MINIO_SECRET_KEY=legacyhub-secret
-MINIO_BUCKET_ORIGINALS=legacyhub-originals
-MINIO_BUCKET_DERIVED=legacyhub-derived
+MINIO_BUCKET_ORIGINALS=teamhub-legacyhub-originals
+MINIO_BUCKET_DERIVED=teamhub-legacyhub-derived
+MINIO_BUCKET_QUARANTINE=teamhub-legacyhub-quarantine
+MINIO_BUCKET_TMP=teamhub-legacyhub-tmp
+MINIO_BUCKET_EXPORTS=teamhub-legacyhub-exports
 MINIO_SECURE=false
 MINIO_REGION=us-east-1
 
@@ -70,18 +73,45 @@ HYBRID_RRF_K=60
 RERANK_CANDIDATES=40
 
 # ==== App ====
+# dev | prod — non-dev makes empty secrets a hard startup error.
+APP_ENV=dev
 APP_LOG_LEVEL=INFO
 APP_HOST=0.0.0.0
+# APP_PORT is the in-container uvicorn bind (do not change for federation).
 APP_PORT=8000
+# API_HOST_PORT is the published host port (8000 collides with SalesHUB / old
+# dispatch dev; LegacyHUB uses 8050).
+API_HOST_PORT=8050
 APP_INPUT_DIR=/data/input
 APP_WORK_DIR=/data/work
 APP_API_PREFIX=/api/v1
 
 # Comma-separated list of allowed origins for the browser. Use specific origins
 # in production; * is accepted only for local development.
-CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5273,http://localhost:4173
+CORS_ALLOWED_ORIGINS=http://localhost:5273,http://localhost:4173
 
 # Optional shared-secret API key. When empty, the API is open (dev default).
 # When set, every request under APP_API_PREFIX except /health requires
 # X-API-Key: <value>  or  Authorization: Bearer <value>.
 API_KEY=
+
+# Service-to-service key required on the participant ingest endpoints
+# (/knowledge-ingest, /ingest/folder). Falls back to API_KEY when empty.
+INGEST_API_KEY=
+
+# Trusted-header identity enforcement (gateway/SSO). Leave false for direct
+# local dev; set true when running behind the TeamHUB gateway.
+AUTH_REQUIRE_IDENTITY=false
+AUTH_APP_CODE=legacyhub
+
+# Deprecated local folder ingest (use /knowledge-ingest instead).
+ENABLE_FOLDER_INGEST=false
+
+# ==== Dispatch (inter-module event bus, D4) ====
+# Disabled for standalone dev. Behind the platform set the dispatch-api URL +
+# this module's participant X-API-Key.
+DISPATCH_ENABLED=false
+DISPATCH_API_URL=
+DISPATCH_API_KEY=
+DISPATCH_PARTICIPANT_CODE=legacyhub
+DISPATCH_TIMEOUT_SECONDS=5