[feat](maestro): serve the public hub app from an embedded bundle

The browser hub is a status/metadata reader for an instance, separate from the operator console and its owner cookies. Build it as its own Preact bundle at /hub/ outside the owner gate, embed it via //go:embed all:hub/dist (with a committed index placeholder so a clean checkout still builds), and apply a strict CSP because it shares the console origin. The Docker build stages the hub build alongside the console; dist assets remain ignored.

Dockerfile.debug

@@ -26,6 +26,15 @@ RUN bun ci
 COPY src/frontend/ ./
 RUN bun run build
 
+# Stage 1b: Build the PUBLIC hub SPA bundle (separate bundle, served at /hub/
+# outside the owner gate; browser-edge contract §10.5).
+FROM oven/bun:1.3.9-alpine AS hub-builder
+WORKDIR /app
+COPY src/hub/package.json src/hub/bun.lock ./
+RUN bun ci
+COPY src/hub/ ./
+RUN bun run build
+
 # Stage 2: Build the static Go binary
 FROM golang:1.26-alpine AS go-builder
 WORKDIR /app
@@ -34,6 +43,8 @@ RUN go mod download
 COPY src/ .
 # Copy the built UI into the frontend folder so go:embed finds it
 COPY --from=frontend-builder /app/dist ./frontend/dist
+# Copy the built hub SPA into hub/dist so go:embed all:hub/dist finds it
+COPY --from=hub-builder /app/dist ./hub/dist
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /server .
 
 # Stage 3: Debug-final image (alpine base, not scratch, for shell access)