feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.prod.example

@@ -14,8 +14,11 @@ POSTGRES_PASSWORD=__ROTATE_ME__
 MINIO_ENDPOINT=minio:9000
 MINIO_ACCESS_KEY=__ROTATE_ME__
 MINIO_SECRET_KEY=__ROTATE_ME__
-MINIO_BUCKET_ORIGINALS=legacyhub-originals
-MINIO_BUCKET_DERIVED=legacyhub-derived
+MINIO_BUCKET_ORIGINALS=teamhub-legacyhub-originals
+MINIO_BUCKET_DERIVED=teamhub-legacyhub-derived
+MINIO_BUCKET_QUARANTINE=teamhub-legacyhub-quarantine
+MINIO_BUCKET_TMP=teamhub-legacyhub-tmp
+MINIO_BUCKET_EXPORTS=teamhub-legacyhub-exports
 MINIO_SECURE=true
 MINIO_REGION=us-east-1
 
@@ -63,9 +66,11 @@ HYBRID_RRF_K=60
 RERANK_CANDIDATES=40
 
 # ==== App ====
+APP_ENV=prod
 APP_LOG_LEVEL=INFO
 APP_HOST=0.0.0.0
 APP_PORT=8000
+API_HOST_PORT=8050
 APP_INPUT_DIR=/data/input
 APP_WORK_DIR=/data/work
 APP_API_PREFIX=/api/v1
@@ -75,3 +80,19 @@ CORS_ALLOWED_ORIGINS=https://legacyhub.teamhub.example
 
 # Mandatory in production. Use a long random value (e.g. `openssl rand -hex 32`).
 API_KEY=__ROTATE_ME__
+
+# Service-to-service key for participant ingest endpoints. Set a distinct value
+# per participant; falls back to API_KEY when empty.
+INGEST_API_KEY=__ROTATE_ME__
+
+# Behind the gateway this must be true so the API rejects requests lacking
+# trusted X-TeamHub-* identity headers.
+AUTH_REQUIRE_IDENTITY=true
+AUTH_APP_CODE=legacyhub
+
+# ==== Dispatch (inter-module event bus, D4) ====
+DISPATCH_ENABLED=true
+DISPATCH_API_URL=http://dispatch-api:8000
+DISPATCH_API_KEY=__ROTATE_ME__
+DISPATCH_PARTICIPANT_CODE=legacyhub
+DISPATCH_TIMEOUT_SECONDS=5