Implement WP-0011 hub service, CLI, and deployment artifacts

Add FederationHubAPI spec, hub registration schema, FastAPI hub with SQLite
persistence, reuse-surface hub CLI client, Dockerfile, and hub tests. Activate
workplan; T05 deploy and T06 ops docs remain open pending railiance01 cutover.

reuse_surface/hub/compose.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+from reuse_surface.federation import compose_federated_index
+from reuse_surface.hub.store import HubStore
+
+DEFAULT_DOMAIN = os.environ.get("REUSE_SURFACE_HUB_DOMAIN", "helix_forge")
+
+
+def registrations_to_manifest(
+    registrations: list[dict[str, Any]],
+    *,
+    domain: str = DEFAULT_DOMAIN,
+) -> dict[str, Any]:
+    sources: list[dict[str, Any]] = []
+    for registration in registrations:
+        source: dict[str, Any] = {
+            "repo": registration["repo"],
+            "url": registration["url"],
+            "enabled": registration.get("enabled", True),
+            "required": registration.get("required", False),
+            "domain": registration.get("domain", domain),
+        }
+        if registration.get("description"):
+            source["description"] = registration["description"]
+        if registration.get("cache_ttl_seconds") is not None:
+            source["cache_ttl_seconds"] = registration["cache_ttl_seconds"]
+        if registration.get("auth_env"):
+            source["auth_env"] = registration["auth_env"]
+        if registration.get("auth_header"):
+            source["auth_header"] = registration["auth_header"]
+        sources.append(source)
+    return {
+        "version": 1,
+        "domain": domain,
+        "collision_policy": "warn",
+        "sources": sources,
+    }
+
+
+def compose_from_store(
+    store: HubStore,
+    *,
+    refresh: bool = False,
+    cache_dir: Path | None = None,
+    domain: str = DEFAULT_DOMAIN,
+) -> tuple[dict[str, Any], list[str]]:
+    manifest = registrations_to_manifest(store.list_repos_internal(), domain=domain)
+    return compose_federated_index(manifest, refresh=refresh, cache_dir=cache_dir)