feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/db/audit.py

@@ -0,0 +1,47 @@
+"""Audit-trail helper.
+
+Single entry point for recording write operations. Callers pass the *active*
+session so the audit row commits in the same transaction as the mutation it
+describes (platform security baseline: audit on every write).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from sqlalchemy.orm import Session
+
+from app.common.json_logger import redact_secrets
+from app.db.models import AuditLog
+
+
+def record_audit(
+    db: Session,
+    *,
+    action: str,
+    actor: str | None = None,
+    actor_id: str | None = None,
+    app_code: str | None = None,
+    entity_type: str | None = None,
+    entity_id: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> AuditLog:
+    """Add an :class:`AuditLog` row to ``db`` (not committed here).
+
+    ``details`` is passed through :func:`redact_secrets` so an accidental
+    secret in the payload is never persisted.
+    """
+    entry = AuditLog(
+        action=action,
+        actor=actor,
+        actor_id=actor_id,
+        app_code=app_code,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        details=redact_secrets(details or {}),
+    )
+    db.add(entry)
+    return entry
+
+
+__all__ = ["record_audit"]

app/db/migrations/versions/0003_audit_log.py

@@ -0,0 +1,49 @@
+"""audit log
+
+Revision ID: 0003_audit_log
+Revises: 0002_asset_ingest_jobs
+Create Date: 2026-06-15
+
+"""
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "0003_audit_log"
+down_revision: str | None = "0002_asset_ingest_jobs"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "audit_log",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("actor", sa.Text, nullable=True),
+        sa.Column("actor_id", sa.Text, nullable=True),
+        sa.Column("app_code", sa.Text, nullable=True),
+        sa.Column("action", sa.Text, nullable=False),
+        sa.Column("entity_type", sa.Text, nullable=True),
+        sa.Column("entity_id", sa.Text, nullable=True),
+        sa.Column(
+            "details",
+            postgresql.JSONB,
+            nullable=False,
+            server_default=sa.text("'{}'::jsonb"),
+        ),
+    )
+    op.create_index("ix_audit_entity", "audit_log", ["entity_type", "entity_id"])
+    op.create_index("ix_audit_action", "audit_log", ["action"])
+    op.create_index("ix_audit_created", "audit_log", ["created_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_audit_created", table_name="audit_log")
+    op.drop_index("ix_audit_action", table_name="audit_log")
+    op.drop_index("ix_audit_entity", table_name="audit_log")
+    op.drop_table("audit_log")

app/db/models.py

@@ -303,3 +303,32 @@ class ProcessingEvent(Base):
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), nullable=False
     )
+
+
+class AuditLog(Base):
+    """Append-only audit trail for write operations.
+
+    Required by the platform security baseline (CONVENTIONS "all write-ops ->
+    audit_log in the same transaction", 03_INTEGRATION_STANDARDS §10). Rows are
+    written via :func:`app.db.audit.record_audit` inside the same
+    ``session_scope`` transaction as the mutation they describe.
+    """
+
+    __tablename__ = "audit_log"
+    __table_args__ = (
+        Index("ix_audit_entity", "entity_type", "entity_id"),
+        Index("ix_audit_action", "action"),
+        Index("ix_audit_created", "created_at"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+    actor: Mapped[str | None] = mapped_column(Text, nullable=True)
+    actor_id: Mapped[str | None] = mapped_column(Text, nullable=True)
+    app_code: Mapped[str | None] = mapped_column(Text, nullable=True)
+    action: Mapped[str] = mapped_column(Text, nullable=False)
+    entity_type: Mapped[str | None] = mapped_column(Text, nullable=True)
+    entity_id: Mapped[str | None] = mapped_column(Text, nullable=True)
+    details: Mapped[dict[str, Any]] = mapped_column(JSONB, nullable=False, default=dict)