feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/schemas.py

@@ -190,6 +190,8 @@ class Citation(BaseModel):
     block_id: str | None = None
     table_id: str | None = None
     figure_id: str | None = None
+    # Source identity comes from asset_id (10 §8.4), never from the filename.
+    asset_id: str | None = None
 
 
 class SearchHit(BaseModel):
@@ -198,7 +200,12 @@ class SearchHit(BaseModel):
     document_id: uuid.UUID
     chunk_id: uuid.UUID
     original_file_name: str
+    # source_path is an s3:// ref for asset ingests; legacy folder ingest (now
+    # deprecated) produced local paths. Prefer asset_id / owner_module for
+    # identity and cross-module references.
     source_path: str
+    asset_id: str | None = None
+    owner_module: str | None = None
     page_number: int
     block_type: str
     text: str
@@ -213,3 +220,22 @@ class SearchResponse(BaseModel):
     total_candidates: int
     reranked: bool
     results: list[SearchHit]
+
+
+# ---------------- Dispatch (inter-module bus) ----------------
+
+class DispatchEnvelope(BaseModel):
+    message_id: str | None = None
+    event_id: str = Field(..., min_length=1)
+    card_uid: str | None = None
+    message_type: str = Field(..., min_length=1)
+    participant_code: str | None = None
+    created_at: str | None = None
+    body: dict[str, Any] = Field(default_factory=dict)
+
+
+class DispatchConfirm(BaseModel):
+    status: str
+    event_id: str
+    handled: bool | None = None
+    duplicate: bool | None = None