Hub stage 4: its own image and pipeline

docker/Dockerfile.hub builds the console and ships it with the hub sources on
node:22-alpine, without node_modules, as a non-root user with a healthcheck.
.gitea/workflows/hub.yaml checks and pushes git.shx.one/denozord/technitium-hub
(latest from main, sha-*, X.Y.Z and X.Y from hub-v tags), independent of the console
pipeline, which now ignores hub-only changes. Compose example for hub.shnt.top and
hub/README.md, with the read-only permissions each server's token needs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -4,6 +4,13 @@ on:
   push:
     branches: [main]
     tags: ['v*']
+    # The hub has its own pipeline (hub.yaml): a change that only touches it does
+    # not rebuild the console.
+    paths-ignore:
+      - 'hub/**'
+      - 'docker/Dockerfile.hub'
+      - '.gitea/workflows/hub.yaml'
+      - 'docs/compose.hub.example.yaml'
   pull_request:
     branches: [main]
   workflow_dispatch: