Hub stage 0: own users with roles, login limit, audit log, permission table

Users in HUB_DATA/users.json with scrypt hashes and roles (viewer, operator,
apps-admin, admin), managed by hub/users-cli.ts; HUB_USER/HUB_PASSWORD remain a
bootstrap admin while the file does not exist. Five failed logins in 15 minutes lock
the address or the name for 15 minutes. Logins, logouts and every refused request go
to a JSON Lines audit log that admins read through hub/audit/list. Endpoints are
listed in routes.ts with their kind and capability; writes stay refused for now.
Optional <ID>_ADMIN_TOKEN is read for the coming write stages. The management plan
is in docs/hub-management-plan.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/compose.shnt.example.yaml

@@ -181,14 +181,20 @@ services:
     restart: unless-stopped
     networks:
       - dns-net
+    volumes:
+      - technitium-hub-data:/data
     environment:
       # id=адрес по порядку; токен каждого из <ID>_TOKEN. Сервер на ЭТОМ же хосте можно
       # указать изнутри сети, мимо Traefik: ndns=http://technitium-smart:5380
       - HUB_SERVERS=mdns=https://mdns.shnt.top,ndns=https://ndns.shnt.top
       - MDNS_TOKEN=${MDNS_TOKEN}
       - NDNS_TOKEN=${NDNS_TOKEN}
+      # Только пока нет /data/users.json; потом пользователи создаются через users-cli (docs/hub-deploy.md)
       - HUB_USER=${HUB_USER}
       - HUB_PASSWORD=${HUB_PASSWORD}
+      - HUB_DATA=/data
+      # За Traefik: брать адрес клиента из X-Forwarded-For (для ограничения попыток входа и журнала)
+      - HUB_TRUST_PROXY=1
       - HUB_DOMAIN=dnss.shnt.top
       - TZ=Asia/Novosibirsk
     labels:
@@ -209,3 +215,4 @@ networks:
 volumes:
   technitium-data:
   technitium-console:
+  technitium-hub-data: