AUD-49: build the Hub skeleton (hear-route-answer)

- Three inbound routes from docs/hub-api.md: POST /ask, POST /approve, GET /health.
- Five-step pipeline in src/hub, with packages hear, understand, check, route, answer.
- Routing through OmniRoute with the capability list and routing.md. The
  never-route control check runs before any LLM call.
- One real destination: Jervis house TTS, started out of band.
- Fake /ask project (src/tests/fakeproject) for the round-trip test.
- Append-only, size-capped request log. Bearer auth, source match, rate limit.
- Tests: all packages pass, including the fake /ask round trip. Race clean.
- Dockerfile and compose updated to mount routing.md and secrets, log on tmpfs.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

README.md

@@ -7,6 +7,8 @@ shared by the phone app, the house voice, chat, and the admin app.
 
 - **Core Technologies**: Go 1.25 service · HTTP JSON API · MQTT · LLM
   intent routing · OmniRoute gateway · Docker
+- **Entry routes**: `POST /ask` · `POST /approve` · `GET /health`
+  (frozen in `docs/hub-api.md`)
 - **Key Tools**: Jervis (voice) · Home Assistant · Paperclip · Artemis ·
   internet use control · Apprise / NTFY · OmniRoute
 - **Engineering Capabilities**: service design · intent routing · authorization
@@ -15,16 +17,41 @@ shared by the phone app, the house voice, chat, and the admin app.
 
 ## Quick Start
 
+### Run the Hub
+
+```bash
+# Build and run the container (Docker host 192.168.20.13).
+docker compose up -d --build
+
+# Liveness (no token).
+curl -s http://192.168.20.13:8788/health
+
+# Ask a question (source esp32 speaks the reply on the house speakers).
+curl -s -X POST http://192.168.20.13:8788/ask \
+  -H "Authorization: Bearer $HUB_TOKEN_ESP32" \
+  -H "Content-Type: application/json" \
+  -d '{"text":"what does Harry have on today?","asker":"sam","source":"esp32"}'
+```
+
+The Hub reads `HUB_TOKEN_*`, `OMNIROUTE_API_KEY`, and the project tokens from
+`~/.config/environment.d/10-secrets.conf` (mounted read-only, never committed).
+
+### Test without a network
+
+```bash
+scripts/hub-test.sh
+```
+
+The fake `/ask` project in `src/tests/fakeproject/` proves the round trip.
+
+### Phase 1 — prove the Paperclip round trip
+
 ```bash
-# Phase 1 — prove the Paperclip round trip
 # 1. Create an agent API key in Paperclip.
 # 2. Export it for the test only.
 export PAPERCLIP_API_KEY=<redacted>
 # 3. File one job.
-curl -s -X POST http://192.168.20.13:3100/api/issues \
-  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"title":"round-trip test","description":"prove the return path"}'
+scripts/paperclip-roundtrip.sh --title "round-trip test"
 ```
 
 Full steps: `docs/outline/04-agent-runbook.md`.