AUD-49: build the Hub skeleton (hear-route-answer)

- Three inbound routes from docs/hub-api.md: POST /ask, POST /approve, GET /health.
- Five-step pipeline in src/hub, with packages hear, understand, check, route, answer.
- Routing through OmniRoute with the capability list and routing.md. The
  never-route control check runs before any LLM call.
- One real destination: Jervis house TTS, started out of band.
- Fake /ask project (src/tests/fakeproject) for the round-trip test.
- Append-only, size-capped request log. Bearer auth, source match, rate limit.
- Tests: all packages pass, including the fake /ask round trip. Race clean.
- Dockerfile and compose updated to mount routing.md and secrets, log on tmpfs.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/hub-test.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+#
+# hub-test.sh - run the Hub unit and round-trip tests.
+#
+# The tests use the fake /ask project. They need no network and no secrets.
+# They run in the golang container so the host does not need a Go toolchain.
+#
+# Usage:
+#   scripts/hub-test.sh            # run all tests
+#   scripts/hub-test.sh -race      # extra args go to "go test"
+#
+set -euo pipefail
+
+readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+readonly PROJECT_DIR="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+readonly GO_IMAGE="${HUB_GO_IMAGE:-golang:1.25-alpine}"
+
+command -v docker >/dev/null 2>&1 || { echo "error: docker is required" >&2; exit 1; }
+
+# The mount is read-only so a test run can never change the source tree.
+docker run --rm \
+  -v "$PROJECT_DIR/src":/src:ro \
+  -w /src \
+  "$GO_IMAGE" \
+  go test "$@" ./...