docs: design and plan HumWatch 2.1 fleet hub

[StaticHumStudio]

What changed

• Defines the approved HumWatch 2.1 fleet hub architecture
• Replaces shared browser tokens and mandatory TLS with owner sessions, one-time enrollment, explicit listeners, and optional HTTPS
• Specifies movable hub authority, offline buffering, recovery, and a read-only SlipShell integration boundary
• Splits implementation into 15 dependency-ordered PRs below the 800-line and 25-file ceilings
• Adds exact TDD steps, interfaces, verification canaries, surface evidence, and new-session reentry instructions

Why

HumWatch 2.0 regressed day-to-day access by making each PC a separate token and certificate problem. The 2.1 design restores one authenticated web hub reachable by IP and port over ordinary LAN or optional Tailscale, while keeping every enrolled machine capable of taking over as hub.

Validation

• Independent Luna review loop: zero actionable findings
• .venv/bin/python -m pytest -q: 241 passed, 5 skipped
• Plan structure: 15 tasks, every task below 25 files
• git diff --check: clean
• Gitleaks over all local commits: no findings after two documented identifier false positives

Implementation handoff

After this PR merges, start Task 1 from fresh origin/main in a new worktree. Task 1 closes #14 by preserving and proving the real 2.0 SQLite database before any fleet migration.