feat: publish the Hub through a reverse proxy on another host

GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the
Hub host, so the Hub must be reachable on the LAN — by the proxy only.

- docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts
  X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and
  session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the
  previous behaviour.
- restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published
  ports bypass UFW, so the source restriction lives in DOCKER-USER,
  matched on the conntrack original destination with --ctdir ORIGINAL,
  and is re-applied whenever docker.service starts (the chain is not
  persisted across reboots).
- *.service forced to LF like *.sh; tests cover both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/hub/gti-fiscal-hub-port.service

@@ -0,0 +1,20 @@
+# Re-applies the Hub port restriction (restrict_hub_port.sh) whenever Docker starts.
+# Install:
+#   sudo install -m 0755 restrict_hub_port.sh /usr/local/sbin/gti-fiscal-restrict-hub-port
+#   printf 'HUB_BIND=10.0.10.117\nHUB_PORT=8000\nPROXY_IP=10.0.10.100\nIFACE=ens18\n' | sudo tee /etc/default/gti-fiscal-hub-port
+#   sudo install -m 0644 gti-fiscal-hub-port.service /etc/systemd/system/
+#   sudo systemctl daemon-reload && sudo systemctl enable --now gti-fiscal-hub-port.service
+[Unit]
+Description=GTI Fiscal: allow the Hub port only from the reverse proxy
+After=docker.service
+Requires=docker.service
+PartOf=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/default/gti-fiscal-hub-port
+ExecStart=/usr/local/sbin/gti-fiscal-restrict-hub-port
+
+[Install]
+WantedBy=docker.service