Start Hub without a preconfigured auth secret

[boudra]

Ordinary self-hosted Hub startup now creates and reuses one durable authentication and execution-authority secret. Operators can start with the embedded default or PostgreSQL without first manufacturing PASEO_HUB_AUTH_SECRET; advanced deployments retain an explicit environment override.

Goals

• Generate one 64-hex authentication secret on first startup and persist it through the existing database-runtime seam.
• Reuse the stored secret across restarts for both browser authentication and execution capabilities.
• Give PASEO_HUB_AUTH_SECRET precedence without overwriting the stored generated value, so removing the override returns to the durable secret.
• Derive the zero-environment public URL from the effective PORT, while preserving an explicit PASEO_HUB_APP_URL exactly.
• Unwind every acquired startup resource in reverse order when runtime configuration, authentication initialization, provider startup, or later application composition fails.
• Keep deployment examples and Hub-owned setup documentation aligned with automatic durable generation.

Non-goals

• Owner welcome or first-owner UI flows.
• Provider setup or credential onboarding.
• NPX packaging or a new distribution entry point.

Why

Embedded storage removed the external database requirement from ordinary local startup, but Hub still required operators to generate and preserve a separate secret before browser authentication and execution capabilities were available. Runtime identity now has one storage-backed owner, while the environment remains an explicit deployment override rather than a second source of durable state.

Related work

• PR #45 — Add a driver-neutral database runtime seam established the shared PostgreSQL/PGlite ownership boundary used for durable runtime configuration.
• PR #46 — Make embedded storage the local Hub default established zero-service startup; this PR removes the remaining mandatory secret from that ordinary startup path.

No open Hub issue or pull request covers this behavior, so this PR does not supersede or close another thread.

Verification

Exact accepted-head evidence:

• Focused runtime configuration, embedded startup cleanup, and application composition regressions: 12/12 passed.
• Full test suite: 763 passed, 15 source-gated tests skipped.
• Independent PostgreSQL first-write race: 20 runtime/pool owners received one durable 64-hex winner.
• npm run typecheck: passed.
• npm run lint: passed with 0 warnings and 0 errors.
• npm run format:check: passed.
• npm run db:check: passed with no schema drift.
• npm run build: passed.
• npm run docker:smoke: passed.
• Built browser suite against the exact pinned Paseo source commit: 74/74 passed.
• Source-built Hub contract suite against the same pinned source: 6/6 passed with leak-free shutdown evidence.
• git diff --check: passed.

Risk surface

The meaningful risks are first-start secret races, migration compatibility, override precedence, and resource ownership when startup rejects. PostgreSQL coverage uses independent pool owners to exercise database-level atomicity; embedded coverage proves persistence, override restoration, secret non-disclosure, and same-directory reopen after invalid URL and authentication initialization failures. Application composition coverage proves started sources stop before upstream storage closes. The existing single secret remains the authority for both browser authentication and execution capabilities; this PR adds no rotation, encryption, provider, billing, or onboarding behavior.