feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -48,10 +48,10 @@ docker compose exec api python scripts/smoke_test.py
 Health check:
 
 ```bash
-curl http://localhost:8000/api/v1/health | jq .
+curl http://localhost:8050/api/v1/health | jq .
 ```
 
-Open the interactive Swagger docs at <http://localhost:8000/docs>.
+Open the interactive Swagger docs at <http://localhost:8050/docs>.
 
 ## Ingest TeamHUB assets
 
@@ -62,7 +62,7 @@ LegacyHUB reads it by `bucket` + `object_key`, verifies `size_bytes` and
 `asset_id + sha256 + manifest_version`, then builds OCR/search projections.
 
 ```bash
-curl -X POST http://localhost:8000/api/v1/knowledge-ingest \
+curl -X POST http://localhost:8050/api/v1/knowledge-ingest \
   -H "Content-Type: application/json" \
   -H "X-API-Key: ${LEGACYHUB_API_KEY}" \
   -H "Idempotency-Key: evt_01J..." \
@@ -128,7 +128,7 @@ mounts `./data/input` for you), drop PDFs into it, and call the compatibility
 endpoint:
 
 ```bash
-curl -X POST http://localhost:8000/api/v1/ingest/folder \
+curl -X POST http://localhost:8050/api/v1/ingest/folder \
   -H "Content-Type: application/json" \
   -d '{"path":"/data/input","recursive":true,"force":false}'
 ```
@@ -150,7 +150,7 @@ docker compose exec api python scripts/reindex_document.py \
 ## Search
 
 ```bash
-curl -X POST http://localhost:8000/api/v1/search \
+curl -X POST http://localhost:8050/api/v1/search \
   -H "Content-Type: application/json" \
   -d '{
         "query": "ГОСТ 21.501-93 рабочие чертежи",
@@ -176,11 +176,11 @@ with citations.
 
 | Service       | URL                                  | Credentials                |
 |---------------|--------------------------------------|----------------------------|
-| API docs      | <http://localhost:8000/docs>         | -                          |
+| API docs      | <http://localhost:8050/docs>         | -                          |
 | MinIO console | <http://localhost:9001>              | `legacyhub` / `legacyhub-secret` |
 | OpenSearch    | <http://localhost:9200>              | -                          |
 | Qdrant UI     | <http://localhost:6333/dashboard>    | -                          |
-| Postgres      | `localhost:5432`                     | `legacyhub` / `legacyhub`  |
+| Postgres      | `localhost:5440`                     | `legacyhub` / `legacyhub`  |
 
 ```bash
 # Count docs in OpenSearch
@@ -295,7 +295,10 @@ legacy-knowledge-indexer/
   noisy OCR.
 - Figure description does not invoke a VLM; captions plus a placeholder are
   used. Plug a VLM into `figure_processor.persist_figures` if needed.
-- No authentication on the API surface - put it behind your reverse proxy.
+- Auth is layered: an optional shared-secret `X-API-Key` (defence in depth,
+  mandatory on ingest endpoints when set) plus gateway/SSO trusted `X-TeamHub-*`
+  headers when `AUTH_REQUIRE_IDENTITY=true`. The module performs no own login and
+  must be reachable only behind the gateway (see RUNBOOK "Network model").
 
 ## License