Choose the hub: Settings' choice, else the install's channel's; state kept per hub

The client's Settings > T5DE chooses the hub from the next start on (POST /hub/server, kept in server.json);
without a choice, -channel (which the client passes) decides: staging for nightly and dev, T5DE's hub for
releases. $T5DE_HUB still wins. Each hub's sign-in, product IDs and products are kept in their own folder
(T5DE's hub in the data folder as before, others in hubs/<host>), so a hub never gets another's token and
product IDs from two hubs never clash; a sign-in saved for another hub is ignored. Signing in always goes to
this run's hub.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -60,10 +60,17 @@ last check, `products.Guard` refuses any request to IMVU that still names a loca
 
 ## The hub
 
+Which hub: `$T5DE_HUB` if set, else the one chosen in the client's Settings > T5DE (kept in
+`%APPDATA%\T5DE\proxy\server.json`, used from the next start), else the install's channel's (`-channel`, which
+the client passes): T5DE's hub (`https://hub.t5de.dev`) for releases, staging (`https://hub.staging.t5de.dev`) for
+nightlies and builds outside an install (`dev`). What belongs to a hub (its sign-in, product IDs, its products) is
+kept per hub: in `%APPDATA%\T5DE\proxy` for T5DE's hub, in `hubs\<host>` under it for others, so a hub never gets
+another's sign-in, and product IDs from two hubs never clash.
+
 The client's Settings > T5DE page signs in and out (the proxy answers it at `http://t5de-proxy.local/hub`,
 `internal/control`). `t5de-proxy signin [-hub URL]` also signs the proxy in to T5DE's hub (git.t5de.dev/t5de/t5de-hub; URL is the hub's
 API): it shows a code to enter on the hub's website (`/device`, OAuth 2.0 device authorization) and saves the
-session token it gets in `%APPDATA%\T5DE\proxy\hub.json`, encrypted for the Windows user (DPAPI). From then on the
+session token it gets in `hub.json` in the hub's folder, encrypted for the Windows user (DPAPI). From then on the
 running proxy keeps a WebSocket to the hub (`internal/hub`) with the token as a bearer token, reporting which IMVU
 account the client signed in as, the community products it wears, and the IMVU chats it's in. If the hub ends the
 session (signed out everywhere, banned), the proxy stops connecting until `signin` is run again.