fix(ingest): flush Document before FK inserts; build fixes; shared-minio overlay

Единый механизм: talk-send.ps1 (Nextcloud Talk) и tg-send.ps1 (engine
teamhub-telegram-bridge из TeamHUB/Engines). Подпись агента обязательна,
созвоны от имени агента не предлагать.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -26,3 +26,5 @@ var/
 # local preview launch config
 frontend/.claude/
 .claude/launch.json
+
+.env.*.bak

AGENTS.md

@@ -194,3 +194,12 @@ docker compose config --quiet
 - New repeated agent rule — update this file.
 - New deployment / recovery step — update `RUNBOOK.md`.
 - Cleanup findings — `docs/cleanup-report.md` (create on demand).
+
+## Внешняя связь (агенты)
+
+- Nextcloud Talk: `~/.usms/talk-send.ps1 -File <utf8-файл>` (room `q4toq6w4`).
+- Telegram: `~/.usms/tg-send.ps1 -File <utf8-файл> [-Channel it]` — общий
+  движок `teamhub-telegram-bridge` (`TeamHUB\Engines`); env с токеном/chat id —
+  `~/.usms-codex/telegram-<channel>-bot.env`; значения секретов не печатать.
+- Каждое внешнее сообщение подписывать: `— AI-агент TeamHUB (Claude)`.
+- Созвоны и встречи от имени агента не предлагать: агент в них не участвует.

app/ingestion/knowledge_ingest.py

@@ -139,6 +139,13 @@ class SqlAlchemyKnowledgeIngestRepository:
                     if existing_doc.status == DocumentStatus.DISCOVERED:
                         existing_doc.status = DocumentStatus.STORED_ORIGINAL
 
+                # Flush the Document row before FK-dependent inserts: there is no
+                # ORM relationship between AssetIngestJob/DocumentArtifact and
+                # Document, so the unit of work does not order these INSERTs and
+                # PostgreSQL rejects the job row with a ForeignKeyViolation
+                # (SQLite-based tests do not enforce FKs, hence unseen there).
+                db.flush()
+
                 ensure_artifact(
                     db,
                     document_id=document_id,

docker-compose.shared-minio.yml

@@ -0,0 +1,28 @@
+# Shared-minio migration overlay (phase 1 of
+# TeamHUB-Platform/docs/submodules/plans/2026-07-08-shared-minio-migration-prompt.md).
+# Attaches ONLY api and worker to the shared teamhub_net so they can reach the
+# platform MinIO (alias teamhub-minio) from container start. Unlike
+# docker-compose.teamhub.yml this overlay does not strip host ports from data
+# services and does not enable AUTH_REQUIRE_IDENTITY - local debug contour.
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.shared-minio.yml up -d --no-deps api worker
+
+networks:
+  teamhub_net:
+    external: true
+    name: teamhub_net
+
+services:
+  api:
+    networks:
+      edge: {}
+      legacyhub_db: {}
+      teamhub_net:
+        aliases: [legacyhub-api]
+
+  worker:
+    networks:
+      edge: {}
+      legacyhub_db: {}
+      teamhub_net: {}

docker/Dockerfile

@@ -22,6 +22,7 @@ RUN apt-get update \
         build-essential \
         curl \
         ca-certificates \
+        git \
         ghostscript \
         qpdf \
         unpaper \
@@ -51,7 +52,14 @@ COPY pyproject.toml README.md alembic.ini /app/
 COPY app /app/app
 COPY scripts /app/scripts
 
+# Local build: install the recognition engine from a pre-built wheel (the
+# pinned git source lives in a private GitHub repo unreachable from the build
+# container without credentials), then relax the pyproject pin to a version
+# spec inside this layer only - the repo file stays untouched.
+COPY docker/wheels /tmp/wheels
 RUN pip install --upgrade pip wheel setuptools \
+ && pip install /tmp/wheels/*.whl \
+ && sed -i 's|"teamhub-document-recognition-engine @ git+[^"]*"|"teamhub-document-recognition-engine>=0.1.0"|' pyproject.toml \
  && pip install -e .
 
 RUN mkdir -p /data/input /data/work