feat(hub): optional New Relic APM via key-gated entrypoint (closes #3)

[benders]

Closes #3.

Adds optional New Relic APM monitoring to the hub, activated only when the operator sets NEW_RELIC_LICENSE_KEY in .env. The key is never committed, never baked into the image, and verified not to appear in logs.

How it works

• New hub/docker-entrypoint.sh is the container CMD. With the key set, it boots the hub under the agent (node --import newrelic/esm-loader.mjs -r newrelic — the ESM app needs both hooks). Without the key it execs plain node hub/dist/server.js; zero agent code loads.
• Path-based module specifiers because newrelic lives in hub/node_modules under the pnpm workspace layout, and cwd must stay /app so relative data-path defaults (e.g. POUTINE_PASSWORD_KEY_PATH) keep resolving.
• Config is env-only (NEW_RELIC_NO_CONFIG_FILE=true, agent log to stdout). APM entity defaults to poutine-hub-<POUTINE_INSTANCE_ID> so federated hubs reporting to one account show as separate entities.
• @newrelic/native-metrics + @newrelic/fn-inspect added to root pnpm.onlyBuiltDependencies for event-loop/GC/CPU metrics.
• Zero TypeScript changes — dev/native runs never load the agent.

Verification

• pnpm verify green, pnpm lint zero output.
• Docker image smoke-tested both ways: no key → healthy, zero agent log lines; key set → agent 14.3.0 boots to "connecting", hub healthy, key absent from logs (grep count 0).
• Entrypoint branch logic tested with a stub node: no key / key + instance id / key + explicit NEW_RELIC_APP_NAME.
• Confirmed on the live hub: metrics and logs flowing in New Relic.

Docs: README operator section, docs/hub-internals.md (env rows + Observability section), example.env monitoring block.

🤖 Generated with Claude Code