Make hub discovery public

contracts/functional/interaction-reporting-v1.md

@@ -132,6 +132,9 @@ configured, OAuth 2.0 client credentials.
 **OpenAPI spec:** `/api/v2/openapi.json` (live-generated; `widget_type`,
 `event_type`, and `category` fields carry `enum` arrays from the type registries)
 
+`GET /api/v2/hubs` and the vocabulary registry list endpoints are public
+discovery surfaces. Mutating bootstrap operations still require Bearer access.
+
 **New endpoints in v2:**
 - `POST /api/v2/token` — OAuth 2.0 client credentials token exchange
 - `GET /api/v2/hubs` / `POST /api/v2/hubs` — list or create hubs, including