docs(hub): align public docs with v0.3 (#3152)

* docs(hub): align public docs with v0.3

Bring the public workflow, API, authority, activity, and self-hosting guidance in line with the released Hub contracts. Clarify the public HTTPS boundary required by provider events while keeping Hub and PostgreSQL private.

* docs(hub): clarify daemon logout scope

* docs(hub): restore Compose path and simplify TLS guidance

* docs(hub): link the single-repo-team-bot example

public-docs/hub/workflows.md

@@ -2,7 +2,7 @@
 title: Hub workflows
 description: Build ordered Hub workflows with prompts, routing, outputs, and provider authority.
 nav: Workflows
-order: 65
+order: 64
 category: Hub
 ---
 
@@ -55,6 +55,8 @@ A finite input can select among complete named environments:
 name: route-repository
 on: manual.run
 max_runtime: 1h
+filters:
+  from_users: [automation]
 inputs:
   repo:
     type: string
@@ -94,6 +96,8 @@ For dynamic routing, select complete named agents from a finite expression:
 name: route-agent
 on: manual.run
 max_runtime: 1h
+filters:
+  from_users: [automation]
 inputs:
   agent:
     type: string
@@ -192,6 +196,8 @@ Steps run in file order. `if` may read inputs, values, and prior step output:
 name: conditional-review
 on: manual.run
 max_runtime: 1h
+filters:
+  from_users: [automation]
 steps:
   - id: inspect
     environment: paseo