Hub stage 4: its own image and pipeline

docker/Dockerfile.hub builds the console and ships it with the hub sources on
node:22-alpine, without node_modules, as a non-root user with a healthcheck.
.gitea/workflows/hub.yaml checks and pushes git.shx.one/denozord/technitium-hub
(latest from main, sha-*, X.Y.Z and X.Y from hub-v tags), independent of the console
pipeline, which now ignores hub-only changes. Compose example for hub.shnt.top and
hub/README.md, with the read-only permissions each server's token needs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -4,6 +4,13 @@ on:
   push:
     branches: [main]
     tags: ['v*']
+    # The hub has its own pipeline (hub.yaml): a change that only touches it does
+    # not rebuild the console.
+    paths-ignore:
+      - 'hub/**'
+      - 'docker/Dockerfile.hub'
+      - '.gitea/workflows/hub.yaml'
+      - 'docs/compose.hub.example.yaml'
   pull_request:
     branches: [main]
   workflow_dispatch:

.gitea/workflows/hub.yaml

@@ -0,0 +1,81 @@
+# The hub has its own pipeline and its own image (git.shx.one/denozord/technitium-hub),
+# independent of ci.yaml. A change that only touches the console's docs does not run it.
+name: Hub
+
+on:
+  push:
+    branches: [main]
+    tags: ['hub-v*']
+    paths:
+      - 'hub/**'
+      - 'src/**'
+      - 'public/**'
+      - 'index.html'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'vite.config.ts'
+      - 'docker/Dockerfile.hub'
+      - '.gitea/workflows/hub.yaml'
+  workflow_dispatch:
+
+concurrency:
+  group: hub-${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npx vitest run hub
+
+  image:
+    needs: check
+    if: gitea.ref_name == 'main' || startsWith(gitea.ref, 'refs/tags/hub-v')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTION_PAT || secrets.ACTIONS_PAT }}
+
+      # The hub is not named after the repository: its own image. Registry names are lowercase.
+      - name: Resolve image name
+        id: image
+        run: |
+          owner="$(dirname '${{ gitea.repository }}' | tr '[:upper:]' '[:lower:]')"
+          echo "name=git.shx.one/${owner}/technitium-hub" >> "$GITHUB_OUTPUT"
+
+      # A hub-v1.2.3 tag gives 1.2.3 and 1.2 (the prefix is stripped); main gives latest.
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.image.outputs.name }}
+          tags: |
+            type=match,pattern=hub-v(\d+\.\d+\.\d+),group=1
+            type=match,pattern=hub-v(\d+\.\d+)\.\d+,group=1
+            type=raw,value=latest,enable=${{ gitea.ref_name == 'main' }}
+            type=sha,prefix=sha-
+
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/Dockerfile.hub
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ steps.image.outputs.name }}:buildcache
+          cache-to: type=registry,ref=${{ steps.image.outputs.name }}:buildcache,mode=max