feat: align LegacyHUB with TeamHUB platform contract (D2/D4, assets, security)

Close 12 audit-driven platform-compliance gaps on a single branch.

- D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`,
  emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing
  commit (idempotent uuid5), http_inbox route (reindex/tombstone) with
  audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module.
- D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope
  mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY)
  and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net
  + internal db net, api not host-published); RUNBOOK network/firewall section.
- Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets
  renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with
  legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event.
- audit_log model + Alembic 0003 + record_audit on writes (same transaction).
- Secret masking: app/common/json_logger.py recursive mask wired into structlog
  (+ensure_ascii=False); event payloads redacted before persistence.
- Service X-API-Key mandatory on ingest endpoints (defence-in-depth).
- Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved),
  container still listens on 8000.
- Config: no plaintext secret defaults; fail-loud in non-dev (no value leak).
- Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS;
  ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default).
- ADRs: layers mapping, shared-core extraction, UI locale (RU-first).

Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_dispatch.py

@@ -0,0 +1,131 @@
+"""Tests for the dispatch participant client and HTTP inbox."""
+
+from __future__ import annotations
+
+import importlib
+import os
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.integrations import dispatch_client
+
+
+def test_build_envelope_has_required_fields():
+    env = dispatch_client.build_envelope("LegacyhubDocumentIndexed", "card-1", {"x": 1}, event_id="e1")
+    assert env["message_type"] == "LegacyhubDocumentIndexed"
+    assert env["card_uid"] == "card-1"
+    assert env["event_id"] == "e1"
+    assert env["participant_code"] == "legacyhub"
+    assert "message_id" in env and "created_at" in env
+    assert env["body"] == {"x": 1}
+
+
+def test_deterministic_event_id_is_stable_and_distinct():
+    a = dispatch_client.deterministic_event_id("LegacyhubDocumentIndexed", "asset_1")
+    b = dispatch_client.deterministic_event_id("LegacyhubDocumentIndexed", "asset_1")
+    c = dispatch_client.deterministic_event_id("LegacyhubDocumentIndexed", "asset_2")
+    assert a == b
+    assert a != c
+
+
+def test_publish_noop_when_disabled(monkeypatch):
+    # Patch the settings object the module actually holds (it binds settings at
+    # import; other tests may have reloaded app.config to a different instance).
+    monkeypatch.setattr(dispatch_client.settings, "dispatch_enabled", False)
+    assert dispatch_client.publish("X", "card", {}) is None
+
+
+class _FakeResp:
+    def raise_for_status(self) -> None:
+        pass
+
+
+class _FakeHttpx:
+    def __init__(self) -> None:
+        self.calls: list[dict] = []
+
+    def post(self, url, json, headers, timeout):  # noqa: A002 - mirror httpx signature
+        self.calls.append({"url": url, "json": json, "headers": headers})
+        return _FakeResp()
+
+
+def test_publish_posts_when_enabled(monkeypatch):
+    monkeypatch.setattr(dispatch_client.settings, "dispatch_enabled", True)
+    monkeypatch.setattr(dispatch_client.settings, "dispatch_api_url", "http://dispatch-api:47137")
+    monkeypatch.setattr(dispatch_client.settings, "dispatch_api_key", "k")
+    fake = _FakeHttpx()
+    monkeypatch.setattr(dispatch_client, "httpx", fake)
+
+    env = dispatch_client.publish("LegacyhubDocumentIndexed", "card-1", {"x": 1}, event_id="e1")
+    assert env is not None
+    assert len(fake.calls) == 1
+    assert fake.calls[0]["url"].endswith("/messages")
+    assert fake.calls[0]["headers"]["X-API-Key"] == "k"
+
+
+def test_publish_document_indexed_uses_asset_id_as_card(monkeypatch):
+    monkeypatch.setattr(dispatch_client.settings, "dispatch_enabled", True)
+    monkeypatch.setattr(dispatch_client.settings, "dispatch_api_url", "http://dispatch-api:47137")
+    fake = _FakeHttpx()
+    monkeypatch.setattr(dispatch_client, "httpx", fake)
+
+    env = dispatch_client.publish_document_indexed(
+        "doc-uuid", asset_metadata={"asset_id": "asset_9", "owner_module": "qms"}
+    )
+    assert env is not None
+    assert env["card_uid"] == "asset_9"
+    assert env["body"]["asset_id"] == "asset_9"
+    assert env["body"]["owner_module"] == "qms"
+
+
+# ---- inbox route ----
+
+@pytest.fixture
+def dispatch_app(monkeypatch):
+    monkeypatch.setenv("INGEST_API_KEY", "svc-key")
+    monkeypatch.delenv("API_KEY", raising=False)
+    import app.config as cfg
+    import app.main as main_module
+
+    cfg.get_settings.cache_clear()
+    importlib.reload(cfg)
+    importlib.reload(main_module)
+    yield main_module.app
+    for _k in ("API_KEY", "INGEST_API_KEY", "AUTH_REQUIRE_IDENTITY"):
+        os.environ.pop(_k, None)
+    cfg.get_settings.cache_clear()
+    importlib.reload(cfg)
+    importlib.reload(main_module)
+
+
+_ENVELOPE = {"event_id": "evt-1", "message_type": "ReindexRequested", "body": {"asset_id": "a1"}}
+
+
+def test_inbox_rejects_without_service_key(dispatch_app):
+    from app.config import settings
+
+    client = TestClient(dispatch_app)
+    res = client.post(f"{settings.app_api_prefix}/dispatch/inbox", json=_ENVELOPE)
+    assert res.status_code == 401
+
+
+def test_inbox_confirms_with_service_key(dispatch_app, monkeypatch):
+    from app.api import routes_dispatch_inbox
+    from app.config import settings
+
+    monkeypatch.setattr(
+        routes_dispatch_inbox,
+        "handle_inbox_message",
+        lambda env: {"status": "confirmed", "handled": True},
+    )
+    client = TestClient(dispatch_app)
+    res = client.post(
+        f"{settings.app_api_prefix}/dispatch/inbox",
+        headers={"X-API-Key": "svc-key"},
+        json=_ENVELOPE,
+    )
+    assert res.status_code == 200
+    assert res.json()["status"] == "confirmed"
+    assert res.json()["handled"] is True
+    assert res.json()["event_id"] == "evt-1"