Implement WP-0011 hub service, CLI, and deployment artifacts

Add FederationHubAPI spec, hub registration schema, FastAPI hub with SQLite
persistence, reuse-surface hub CLI client, Dockerfile, and hub tests. Activate
workplan; T05 deploy and T06 ops docs remain open pending railiance01 cutover.

workplans/REUSE-WP-0011-federation-hub-on-railiance01.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Federation hub service on railiance01 and hub CLI"
 domain: helix_forge
 repo: reuse-surface
-status: proposed
+status: active
 owner: codex
 topic_slug: helix-forge
 created: "2026-06-15"
@@ -72,7 +72,7 @@ for discovery without cloning every repo.
 |---|---|---|
 | Hub service code, API schema, CLI | `reuse-surface` | This workplan |
 | Container image build and push | `reuse-surface` + `railiance-forge` | OCI registry on `gitea.coulomb.social` |
-| Helm release on `railiance01` | `railiance-apps` | Capability request or companion task |
+| Helm release on `railiance01` | `railiance-apps` | **RAILIANCE-WP-0007** (companion workplan) |
 | Ingress / TLS / DNS | `railiance-apps` + DNS owner | T05 — human confirmation for hostname |
 | Traefik / cert-manager primitives | `railiance-cluster` / `railiance-platform` | Reuse existing stack |
 | Secrets (hub token, TLS) | Operator | SOPS / sealed secrets; never commit plaintext |
@@ -126,7 +126,7 @@ writes `registry/federation/sources.yaml` from hub state for offline compose.
 
 ```task
 id: REUSE-WP-0011-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4ed50506-eef6-4bfc-9e00-65d2aefa9338"
 ```
@@ -140,7 +140,7 @@ hub workplan design section or `docs/decisions/` if scope warrants.
 
 ```task
 id: REUSE-WP-0011-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b12401ab-82f8-433f-a662-06ab71715f25"
 ```
@@ -159,7 +159,7 @@ Add a deployable hub service under `reuse_surface/` (e.g. `hub/` package or
 
 ```task
 id: REUSE-WP-0011-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "38fec6ce-23c0-4157-8350-7d112b9e8264"
 ```
@@ -175,7 +175,7 @@ Extend `reuse-surface` CLI with `hub` subcommands:
 
 ```task
 id: REUSE-WP-0011-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "24eec9ad-21fc-4f0b-8671-72d955b15e68"
 ```
@@ -206,7 +206,7 @@ Deploy the hub as a governed release on `railiance01`:
 - Verify `GET /health` and `GET /v1/federated` from workstation and from cluster
 
 **Blocked on:** DNS decision, operator secret provisioning, and
-`railiance-apps` Helm release slot (may need companion workplan task there).
+**RAILIANCE-WP-0007** Helm chart deploy (T04).
 
 ## Document Operations And Dogfood Registrations
 
@@ -226,7 +226,7 @@ Update `docs/RegistryFederation.md` with hub-centric workflow. Register
 
 ```task
 id: REUSE-WP-0011-T07
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "40871958-f665-4726-9ff6-f8a840d685bd"
 ```