Hub stage 4: its own image and pipeline

docker/Dockerfile.hub builds the console and ships it with the hub sources on
node:22-alpine, without node_modules, as a non-root user with a healthcheck.
.gitea/workflows/hub.yaml checks and pushes git.shx.one/denozord/technitium-hub
(latest from main, sha-*, X.Y.Z and X.Y from hub-v tags), independent of the console
pipeline, which now ignores hub-only changes. Compose example for hub.shnt.top and
hub/README.md, with the read-only permissions each server's token needs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker/Dockerfile.hub

@@ -0,0 +1,31 @@
+# The hub image built by Gitea CI (git.shx.one): one small container that serves the
+# console and a read-only, Technitium-compatible API over several real servers.
+# See hub/README.md. Self-contained: it does not use the console image.
+#
+#   docker run --rm -p 8080:8080 -e HUB_SERVERS=dns=https://dns.example.net \
+#     -e DNS_TOKEN=... -e HUB_USER=admin -e HUB_PASSWORD=... \
+#     git.shx.one/denozord/technitium-hub:latest
+FROM node:22-alpine AS build
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+# What the hub runs: its sources without the tests, and a package.json that makes the
+# .ts files ES modules. It imports only node: built-ins, so there is no node_modules.
+RUN mkdir -p /out/hub \
+ && cp hub/*.ts /out/hub/ \
+ && rm /out/hub/*.test.ts \
+ && echo '{"type":"module"}' > /out/package.json
+
+FROM node:22-alpine
+WORKDIR /app
+COPY --from=build /out/ ./
+COPY --from=build /src/dist ./dist
+ENV HUB_STATIC=/app/dist HUB_PORT=8080 NODE_ENV=production
+USER node
+EXPOSE 8080
+# No curl in alpine: node asks the hub's public endpoint itself.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.HUB_PORT||8080)+'/api/status').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
+CMD ["node", "--experimental-strip-types", "--no-warnings", "/app/hub/server.ts"]