feat: publish the Hub through a reverse proxy on another host

GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the
Hub host, so the Hub must be reachable on the LAN — by the proxy only.

- docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts
  X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and
  session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the
  previous behaviour.
- restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published
  ports bypass UFW, so the source restriction lives in DOCKER-USER,
  matched on the conntrack original destination with --ctdir ORIGINAL,
  and is re-applied whenever docker.service starts (the chain is not
  persisted across reboots).
- *.service forced to LF like *.sh; tests cover both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/hub/docker-compose.prod.yml

@@ -47,6 +47,11 @@ services:
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
       BASE_URL: ${BASE_URL:?BASE_URL is required (public HTTPS URL of the Hub)}
       AGENT_ONLINE_THRESHOLD_SECONDS: ${AGENT_ONLINE_THRESHOLD_SECONDS:-120}
+      # Reverse proxy on another host: uvicorn only honours X-Forwarded-For/-Proto
+      # from these addresses (real client IP in audit/session records, scheme=https).
+      FORWARDED_ALLOW_IPS: ${FORWARDED_ALLOW_IPS:-127.0.0.1}
+      # 1 = session/CSRF cookies are sent only over HTTPS. Set once TLS is in front.
+      WEB_COOKIE_SECURE: ${WEB_COOKIE_SECURE:-0}
       # AGENT_DEV_TOKEN is intentionally NOT set: real Agents are registered with central/scripts/register_agent.py.
     ports:
       - "${HUB_BIND:-127.0.0.1}:${HUB_PORT:-8000}:8000"