[feat](maestro): serve the public hub app from an embedded bundle

The browser hub is a status/metadata reader for an instance, separate from the operator console and its owner cookies. Build it as its own Preact bundle at /hub/ outside the owner gate, embed it via //go:embed all:hub/dist (with a committed index placeholder so a clean checkout still builds), and apply a strict CSP because it shares the console origin. The Docker build stages the hub build alongside the console; dist assets remain ignored.

src/hub/vite.config.ts

@@ -0,0 +1,12 @@
+import { defineConfig } from 'vite'
+import preact from '@preact/preset-vite'
+
+// https://vite.dev/config/
+export default defineConfig({
+  plugins: [preact()],
+  base: '/hub/',
+  build: {
+    outDir: 'dist',
+    emptyOutDir: true,
+  },
+})