feat: provision non-root Hub service

hub/.env.example

@@ -1,5 +1,8 @@
 # Hub runtime configuration. Copy to .env and fill in.
 
+# Production preflight requires the explicit production runtime mode.
+NODE_ENV="production"
+
 # PostgreSQL connection string.
 DATABASE_URL="postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm"
 
@@ -21,18 +24,23 @@ ANTHROPIC_API_KEY=""
 # Agent run policy (optional). Defaults to 25.
 # HUB_AGENT_MAX_TURNS=25
 
-# System-managed root for project workspaces created from org admin / Feishu onboarding.
-HUB_PROJECT_WORKSPACE_ROOT="./data/project-workspaces"
+# Persistent system-managed root for project workspaces. Production must use an
+# absolute path outside the deployment/release tree; install_service.sh defaults
+# to this path and rejects any overlap before installing the unit.
+HUB_PROJECT_WORKSPACE_ROOT="/var/lib/cph-hub/workspaces"
 
 # Feishu (lark) bot credentials.
 FEISHU_APP_ID=""
 FEISHU_APP_SECRET=""
 FEISHU_BOT_OPEN_ID=""
 
-# Path to the `cph` binary (ADR-0016). Defaults to `cph` on PATH.
-# CPH_BIN="/usr/local/bin/cph"
+# Absolute path to the `cph` binary (ADR-0016). Production preflight requires
+# the file to be executable and `cph --version` to succeed.
+CPH_BIN="/usr/local/bin/cph"
 
-# Hub server port. Defaults to 8788.
+# Hub bind address and port. Production defaults to loopback for a local TLS
+# reverse proxy; both values are validated and honored by the HTTP server.
+HOST="127.0.0.1"
 PORT=8788
 
 # --- Org admin web (ADR-0021) ---------------------------------------------
@@ -40,7 +48,7 @@ PORT=8788
 # redirect_uri = ${HUB_PUBLIC_BASE_URL}/auth/feishu/callback
 # Configure the same callback URL in the Feishu developer console under
 # Security Settings → Redirect URLs.
-HUB_PUBLIC_BASE_URL="http://127.0.0.1:8788"
+HUB_PUBLIC_BASE_URL="https://hub.example.com"
 
 # HMAC secret for signed session + OAuth state cookies. Generate with:
 #   openssl rand -base64 32