feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_audit.py

@@ -0,0 +1,52 @@
+"""Tests for the audit-trail helper."""
+
+from __future__ import annotations
+
+from app.db.audit import record_audit
+from app.db.models import AuditLog
+
+
+class _FakeSession:
+    def __init__(self) -> None:
+        self.added: list[object] = []
+
+    def add(self, obj: object) -> None:
+        self.added.append(obj)
+
+
+def test_record_audit_adds_row_with_fields():
+    db = _FakeSession()
+    entry = record_audit(
+        db,
+        action="asset.ingest.registered",
+        actor="alice",
+        app_code="qms",
+        entity_type="document",
+        entity_id="doc-1",
+        details={"asset_id": "asset_1"},
+    )
+    assert db.added == [entry]
+    assert isinstance(entry, AuditLog)
+    assert entry.action == "asset.ingest.registered"
+    assert entry.actor == "alice"
+    assert entry.app_code == "qms"
+    assert entry.entity_type == "document"
+    assert entry.entity_id == "doc-1"
+    assert entry.details == {"asset_id": "asset_1"}
+
+
+def test_record_audit_redacts_secret_in_details():
+    db = _FakeSession()
+    entry = record_audit(
+        db,
+        action="x",
+        details={"api_key": "leak", "asset_id": "a1"},
+    )
+    assert entry.details["api_key"] == "***"
+    assert entry.details["asset_id"] == "a1"
+
+
+def test_record_audit_defaults_details_to_empty_dict():
+    db = _FakeSession()
+    entry = record_audit(db, action="x")
+    assert entry.details == {}