Hub: accounts, IMVU linking by tagline, proxy sign-in, presence, console

People sign up on the website and link IMVU accounts by putting a code in the account's tagline, which the
hub reads from IMVU's public API (the most recent proof wins; link caps per person). IMVU's age verification
or Access Pass make an account adult. T5DE's proxy signs in with a device code and keeps a WebSocket open,
reporting the IMVU account in use and the community products it wears; /online shows those who opted in.
Moderators get a console: who's online, people, link caps, bans, roles, and the audit log. Tests run the
website and API against an embedded Postgres and a fake IMVU API.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -1,6 +1,33 @@
 # t5de-hub
 
-T5DE's hub: accounts linked to IMVU accounts, the registry of community products and catalogs, presence, T5DE-hosted
-rooms, and the website with the moderation console. Part of T5DE (git.t5de.dev/t5de).
+T5DE's hub: accounts linked to IMVU accounts, presence, and (to come) the registry of community products and
+catalogs, T5DE-hosted rooms, and the moderation console. Part of T5DE (git.t5de.dev/t5de). Design:
+[docs/design.md](docs/design.md); what a room needs from a server: [docs/imq-rooms.md](docs/imq-rooms.md).
 
-Design: [docs/design.md](docs/design.md) (draft). No code yet.
+## What works
+
+- **Accounts**: sign-up and sign-in (Argon2id passwords), sessions with CSRF protection. The first account is an
+  admin.
+- **Linking IMVU accounts**: the person puts a code in the account's tagline; the hub reads it from IMVU's public
+  API. The most recent proof wins (an account linked elsewhere moves). Link caps per person (default 10).
+- **Age**: an account counts as adult if IMVU says it's age verified or has Access Pass, checked by the hub.
+- **Proxy sign-in**: OAuth 2.0 device codes (`t5de-proxy signin` shows a code to enter at `/device`); Ed25519 JWT
+  access tokens (keys at `/.well-known/jwks.json`) and rotating refresh tokens.
+- **Presence**: signed-in proxies keep a WebSocket (`/api/v1/realtime`) telling the hub which IMVU account is in
+  use and the community products it wears. `/online` shows accounts that opted in, with the opt-in T5DE badge.
+- **Console** (moderators): counts, who's online (live), people search, link caps, bans, roles, audit log.
+
+## Running it
+
+    go run ./cmd/t5de-hub -dev
+
+runs the hub at http://127.0.0.1:8080 with its own Postgres (downloaded once, kept in `t5de-hub-data/`). In
+production: `t5de-hub -db postgres://... -public-url https://hub.t5de.dev -listen :8080 -data /var/lib/t5de-hub`
+(the data directory holds the token signing key).
+
+To point a T5DE proxy at it: `t5de-proxy signin -hub http://127.0.0.1:8080`.
+
+## Tests
+
+`go test ./...` runs everything, the website and API against a real Postgres (embedded, downloaded on first run
+and cached; `T5DE_PG_CACHE` sets where) and a fake IMVU API.