feat(infra): add hub service — Docker, Traefik, CI/CD

- Add infra/docker/hub.Dockerfile (Next.js multi-stage build)
- Add infra/compose/hub.yml with app-shared-net
- Add Traefik route for hub.asepharyana.{my,web}.id → hub:3000
- Update docker-build-push.yml: path detection, matrix build, dispatch, manifest
- Update deploy-docker.yml: include hub.yml in ALL_COMPOSE_FILES
- Update update-submodule.yml: allow hub service
- Update docs/ARCHITECTURE.md

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/compose/hub.yml

@@ -0,0 +1,16 @@
+services:
+  hub:
+    container_name: hub
+    image: ghcr.io/asepharyana/asepharyana-hub/hub:sha-TODO
+    restart: always
+    networks:
+      app-shared-net:
+        aliases:
+          - hub
+    env_file:
+      - ../../.env
+
+networks:
+  app-shared-net:
+    name: app-shared-net
+    external: true

infra/docker/hub.Dockerfile

@@ -0,0 +1,20 @@
+# ── Build stage ──
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY apps/hub/package.json apps/hub/bun.lock ./
+RUN npm install --frozen-lockfile
+COPY apps/hub .
+RUN npm run build
+
+# ── Runtime ──
+FROM node:22-alpine AS runtime
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+WORKDIR /app
+COPY --from=builder /app/.next ./.next
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/package.json ./
+USER appuser
+EXPOSE 3000
+ENV PORT=3000 NODE_ENV=production
+CMD ["npm", "run", "start"]

infra/traefik/dynamic/apps.yaml

@@ -1,5 +1,15 @@
 http:
   routers:
+    # ── Hub (Portfolio SPA) ──
+    hub:
+      rule: 'Host(`hub.asepharyana.my.id`) || Host(`hub.asepharyana.web.id`)'
+      entryPoints:
+        - websecure
+      tls: {}
+      middlewares:
+        - common-chain@file
+      service: hub-service
+
     # ── Scraper API ──
     scraper:
       rule: 'Host(`scraper.asepharyana.my.id`) || Host(`api.asepharyana.my.id`) || Host(`scraper.asepharyana.web.id`) || Host(`api.asepharyana.web.id`)'
@@ -31,6 +41,11 @@ http:
       service: jaeger-service
 
   services:
+    hub-service:
+      loadBalancer:
+        servers:
+          - url: 'http://hub:3000'
+
     scraper-service:
       loadBalancer:
         servers: