AUD-56: deploy prep - token script, container user fix, runbook

- Add scripts/provision-hub-tokens.sh. It adds the five HUB_TOKEN_* keys to
  ~/.config/environment.d/10-secrets.conf. It is idempotent, keeps mode 600,
  leaves a mode-600 backup, and never prints a value. It uses openssl when
  present and /dev/urandom otherwise (this host has no openssl).
- docker-compose.yml: run the container as the host user. The image's
  distroless nonroot user cannot read the 0600 secrets file. With nonroot the
  Hub read no tokens and every /ask returned 401.
- Document the deploy steps, the finding, and the dry-run evidence in
  docs/outline/04-agent-runbook.md, docs/outline/02-config-and-env.md, README.md.

Dry run on port 18788 with a scratch secrets file: /health ok with
omniroute ok, control action refused, bad token 401. The host secrets file and
the running hub container were not touched.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/outline/02-config-and-env.md

@@ -23,6 +23,14 @@ Relevant keys:
 | `HUB_TOKEN_CONSOLE` | Hub token for the console portal. |
 | `HUB_TOKEN_ADMIN` | Hub token for the admin app. The only trusted door. |
 
+Add the five Hub tokens with `scripts/provision-hub-tokens.sh`. It is
+idempotent, keeps mode 600, and never prints a value. A new token needs Sam's OK
+(`AGENTS.md` "ask first: credentials").
+
+The container runs as the host user (`HUB_UID`/`HUB_GID`, default `1000:100`),
+not the image's `nonroot` user, because the secrets file has mode 0600 and the
+`nonroot` user cannot read it. See `docs/outline/04-agent-runbook.md`.
+
 ## Hub Environment Keys
 
 The Hub reads these keys from the environment, then from the secrets file. The

docs/outline/04-agent-runbook.md

@@ -161,6 +161,87 @@ The `docker-compose.yml` mounts `routing.md` and the secrets file read-only, and
 uses a `/tmp` tmpfs for the log. To deploy: build the image, then restart the
 container. A `HUB_TOKEN_*` key per client must exist in the secrets file first.
 
+## Phase 2 — Deploy the Hub (AUD-56)
+
+The AUD-49 image is built as `central-ai-hub:local`. The `hub` container on port
+8788 must serve that image, and the secrets file must hold one token per door.
+
+### Step 1 — Provision the Hub client tokens
+
+Run the script. It adds only the missing `HUB_TOKEN_*` keys. It never prints a
+token value and never overwrites a token.
+
+```bash
+scripts/provision-hub-tokens.sh --check   # report present or missing, no change
+scripts/provision-hub-tokens.sh           # add the missing keys
+```
+
+The script writes the keys to `~/.config/environment.d/10-secrets.conf`, keeps
+mode 600, and leaves a mode-600 timestamped backup. The keys are:
+`HUB_TOKEN_PHONE`, `HUB_TOKEN_ESP32`, `HUB_TOKEN_DSH`, `HUB_TOKEN_CONSOLE`,
+`HUB_TOKEN_ADMIN`.
+
+This step changes host credentials. It needs Sam's OK first
+(`AGENTS.md` "ask first: credentials").
+
+> This host has no `openssl`. The script uses `openssl rand -hex 32` when it is
+> present, and `/dev/urandom` (32 bytes, hex) otherwise. Both give 64 hex
+> characters.
+
+### Step 2 — Deploy the image
+
+```bash
+cd /home/sam/paseo/projects/central_ai_llm_master
+docker compose up -d --build
+```
+
+### Step 3 — Verify
+
+```bash
+curl -s http://192.168.20.13:8788/health
+docker inspect hub --format '{{.State.Health.Status}}'
+```
+
+Expected: `ok: true`, `omniroute: ok`, and `healthy`. The control action must be
+refused:
+
+```bash
+curl -s -X POST http://192.168.20.13:8788/ask \
+  -H "Authorization: Bearer $HUB_TOKEN_ESP32" \
+  -H "Content-Type: application/json" \
+  -d '{"text":"cut the kids internet","asker":"sam","source":"esp32"}'
+```
+
+Expected: `status: "refused"`, `route.kind: "refused"`.
+
+`HUB_PROJECTS` is empty in this phase. A project question therefore returns
+`status: "unavailable"` with `route.reason: "no_client"`. That is correct.
+
+### Finding — the container user
+
+The secrets file has mode 0600 and is owned by the host user. The image's
+distroless `nonroot` user (65532) cannot read that file. With `nonroot`, the Hub
+starts but reads no tokens: every `/ask` returns 401 and `/health` reports
+`omniroute: unknown`.
+
+Fix: `docker-compose.yml` runs the container as the host user
+(`user: "${HUB_UID:-1000}:${HUB_GID:-100}"`). No host file change is needed.
+
+### Dry-run evidence — 2026-10-10
+
+The AUD-49 image (`sha256:eb062c638da5`) ran on port 18788 against a scratch
+secrets file with freshly generated tokens. It did not touch the host secrets
+file or the running `hub` container.
+
+| Check | Result |
+|---|---|
+| `GET /health` | `ok: true`, `checks.omniroute: ok`, `checks.log: ok` |
+| `POST /ask` `"cut the kids internet"` | `status: "refused"`, `route.kind: "refused"` |
+| `POST /ask` with a bad token | HTTP 401 `unauthorized` |
+| `POST /ask` a project question (no project) | `status: "unavailable"`, `route.reason: "no_client"` |
+| `docker exec <container> /app/hub -healthcheck` | exit 0 (the compose healthcheck) |
+| Container with the image's default `nonroot` user | 401 on `/ask`, `omniroute: unknown` (the finding above) |
+
 ## After Phase 1
 
 Follow the build order in `AGENTS.md`. Do not start a destination before the