Prepare Hub guided self-hosting docs for the next release (#3342)

* docs(hub): drop the manual auth secret from self-hosting setup

Hub generates its authentication secret on first start and stores it in the
database it is already using, so self-hosters no longer run openssl or carry
PASEO_HUB_AUTH_SECRET between restarts. The variable stays as an override for
deployments that must supply the secret from a platform secret store; Hub uses
it without persisting it, so removing it resumes the stored value.

Also corrects a claim that predates this change: rotating the secret does not
invalidate execution credentials already issued. Hub verifies those against
persisted hashes rather than the secret, so only browser sessions end.

Documentation companion to https://github.com/getpaseo/hub/pull/50.

* docs(hub): lead with the local guided setup

* docs(hub): document XDG data directory

* docs: make Hub self-hosting the quickstart

public-docs/hub/index.md

@@ -26,9 +26,9 @@ What that gives you today:
 
 Your daemons keep running agents where they always did. Hub decides when to ask them to.
 
-## What you write
+## What lives in your repository
 
-One project resource file names environments and complete agent configurations. Each discovered workflow file keeps one trigger beside its ordered steps:
+`paseo hub init` creates a project resource file for environments and agents, plus a safe starter workflow:
 
 ```text
 .paseo/
@@ -39,22 +39,23 @@ One project resource file names environments and complete agent configurations.
         └── answer.md
 ```
 
-Push the bundle, mention the bot, and an agent starts on your machine. [Quickstart](/docs/hub/quickstart) builds the first bundle; [Workflows](/docs/hub/workflows) covers routing and provider-specific replies.
+Deploy the bundle, mention the bot, and an agent starts on your machine. [Quickstart](/docs/hub/quickstart) runs the guided setup; [Workflows](/docs/hub/workflows) covers routing and provider-specific replies.
 
 ## Reading order
 
-1. [How it works](/docs/hub/concepts)
-2. [Daemons](/docs/hub/daemons)
-3. [Triggers](/docs/hub/triggers)
-4. [Workflows](/docs/hub/workflows)
-5. [GitHub access](/docs/hub/github)
-6. [Configuration](/docs/hub/configuration)
-7. [Security](/docs/hub/security)
-
-[Quickstart](/docs/hub/quickstart) goes end to end if you would rather start by doing.
+1. [Quickstart](/docs/hub/quickstart)
+2. [How it works](/docs/hub/concepts)
+3. [Daemons](/docs/hub/daemons)
+4. [Triggers](/docs/hub/triggers)
+5. [Workflows](/docs/hub/workflows)
+6. [GitHub access](/docs/hub/github)
+7. [Configuration](/docs/hub/configuration)
+8. [Security](/docs/hub/security)
 
 If a workflow accepts requests from GitHub, Slack, Discord, or the API, read [Hub security](/docs/hub/security) before giving an agent access to a working directory or output capability.
 
-## Where it runs
+## Run Hub yourself
 
-Everything on this page and the pages it links to works the same way on [hosted Hub](/docs/hub/hosted) and on a Hub you run yourself under [self-hosting](/docs/hub/self-hosting).
+Start on your machine with the embedded database, then add PostgreSQL or a public deployment only when you need them. [Self-hosting](/docs/hub/self-hosting) covers each step.
+
+[Hosted Hub](/docs/hub/hosted) uses the same projects, workflows, daemons, and activity model. New account registration is currently closed.