feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/routes_ingestion.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import uuid
 from pathlib import Path
 
-from fastapi import APIRouter, Header, HTTPException, Response, status
+from fastapi import APIRouter, Depends, Header, HTTPException, Response, status
 
 from app.api.schemas import (
     AssetManifestEnvelope,
@@ -13,6 +13,10 @@ from app.api.schemas import (
     IngestFolderResponse,
     KnowledgeIngestResponse,
 )
+from app.api.security import require_service_api_key
+from app.config import settings
+from app.db.audit import record_audit
+from app.db.session import session_scope
 from app.ingestion.knowledge_ingest import KnowledgeIngestError, accept_knowledge_ingest
 from app.logging_config import get_logger
 
@@ -24,6 +28,7 @@ router = APIRouter(tags=["ingestion"])
 @router.post(
     "/knowledge-ingest",
     response_model=KnowledgeIngestResponse,
+    dependencies=[Depends(require_service_api_key)],
 )
 def knowledge_ingest(
     req: AssetManifestEnvelope,
@@ -44,7 +49,12 @@ def knowledge_ingest(
     return result
 
 
-@router.post("/ingest/folder", response_model=IngestFolderResponse, deprecated=True)
+@router.post(
+    "/ingest/folder",
+    response_model=IngestFolderResponse,
+    deprecated=True,
+    dependencies=[Depends(require_service_api_key)],
+)
 def ingest_folder(req: IngestFolderRequest, response: Response) -> IngestFolderResponse:
     """Discover all PDFs under ``path`` and queue them for processing.
 
@@ -56,6 +66,11 @@ def ingest_folder(req: IngestFolderRequest, response: Response) -> IngestFolderR
     """
     response.headers["Deprecation"] = "true"
     response.headers["Link"] = '</api/v1/knowledge-ingest>; rel="successor-version"'
+    if not settings.enable_folder_ingest:
+        raise HTTPException(
+            status_code=status.HTTP_410_GONE,
+            detail="folder ingest is disabled; use POST /api/v1/knowledge-ingest",
+        )
     folder = Path(req.path)
     if not folder.exists() or not folder.is_dir():
         raise HTTPException(status_code=400, detail=f"Folder not found: {req.path}")
@@ -88,6 +103,16 @@ def ingest_folder(req: IngestFolderRequest, response: Response) -> IngestFolderR
         run_id=str(run_id),
     )
 
+    with session_scope() as db:
+        record_audit(
+            db,
+            action="ingest.folder.queued",
+            actor="service:ingest-folder",
+            entity_type="ingestion_run",
+            entity_id=str(run_id),
+            details={"discovered": discovered, "queued": queued, "skipped_duplicates": dups},
+        )
+
     return IngestFolderResponse(
         run_id=run_id,
         discovered=discovered,