AUD-49: build the Hub skeleton (hear-route-answer)

- Three inbound routes from docs/hub-api.md: POST /ask, POST /approve, GET /health.
- Five-step pipeline in src/hub, with packages hear, understand, check, route, answer.
- Routing through OmniRoute with the capability list and routing.md. The
  never-route control check runs before any LLM call.
- One real destination: Jervis house TTS, started out of band.
- Fake /ask project (src/tests/fakeproject) for the round-trip test.
- Append-only, size-capped request log. Bearer auth, source match, rate limit.
- Tests: all packages pass, including the fake /ask round trip. Race clean.
- Dockerfile and compose updated to mount routing.md and secrets, log on tmpfs.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Dockerfile

@@ -6,8 +6,11 @@ COPY src/ ./
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/hub .
 
 FROM gcr.io/distroless/static-debian12:nonroot
-COPY --from=build /out/hub /hub
+WORKDIR /app
+COPY --from=build /out/hub /app/hub
 ENV HUB_PORT=8788
+ENV HUB_ROUTING_FILE=/app/routing.md
+ENV HUB_LOG_PATH=/tmp/hub.log
 EXPOSE 8788
 USER nonroot:nonroot
-ENTRYPOINT ["/hub"]
+ENTRYPOINT ["/app/hub"]