feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -9,8 +9,8 @@ x-common-env: &common-env
   MINIO_ENDPOINT: ${MINIO_ENDPOINT:-minio:9000}
   MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-legacyhub}
   MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-legacyhub-secret}
-  MINIO_BUCKET_ORIGINALS: ${MINIO_BUCKET_ORIGINALS:-legacyhub-originals}
-  MINIO_BUCKET_DERIVED: ${MINIO_BUCKET_DERIVED:-legacyhub-derived}
+  MINIO_BUCKET_ORIGINALS: ${MINIO_BUCKET_ORIGINALS:-teamhub-legacyhub-originals}
+  MINIO_BUCKET_DERIVED: ${MINIO_BUCKET_DERIVED:-teamhub-legacyhub-derived}
   MINIO_SECURE: ${MINIO_SECURE:-false}
   OPENSEARCH_HOST: ${OPENSEARCH_HOST:-opensearch}
   OPENSEARCH_PORT: ${OPENSEARCH_PORT:-9200}
@@ -30,10 +30,11 @@ x-common-env: &common-env
   RERANKER_MODEL: ${RERANKER_MODEL:-BAAI/bge-reranker-v2-m3}
   RERANKER_DEVICE: ${RERANKER_DEVICE:-cpu}
   RERANKER_ENABLED: ${RERANKER_ENABLED:-true}
+  APP_ENV: ${APP_ENV:-dev}
   APP_LOG_LEVEL: ${APP_LOG_LEVEL:-INFO}
   APP_INPUT_DIR: /data/input
   APP_WORK_DIR: /data/work
-  CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:5173,http://localhost:5273,http://localhost:4173}
+  CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:5273,http://localhost:4173}
   API_KEY: ${API_KEY:-}
 
 services:
@@ -138,7 +139,9 @@ services:
       APP_PORT: 8000
     command: ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
     ports:
-      - "8000:8000"
+      # Host port 8050 avoids the 8000 collision (SalesHUB / old dispatch dev).
+      # Container still listens on 8000. Overridden by ${API_HOST_PORT}.
+      - "${API_HOST_PORT:-8050}:8000"
     depends_on:
       postgres:
         condition: service_healthy