Setup repo: migrate architecture specs, code stubs, and tasks from alkhub_ts

Copy architecture docs, ADRs, storage domain specs, research, reviews,
and 56 storage architecture tasks from the alkhub_ts monorepo. Adapt for
standalone @alkdev/hub repo structure (src/ not packages/hub/).

Sanitize all sensitive information:
- Replace private IPs (10.0.0.1) with localhost defaults
- Remove internal server hostnames (dev1, ns528096)
- Replace /workspace/ private paths with npm package references
- Remove hardcoded credentials from examples
- Rewrite infrastructure.md without private network details

Add Deno project scaffolding: deno.json (pinned deps), .gitignore,
AGENTS.md, entry point. Migrate existing code stubs (crypto, config
types, logger) with updated import paths.

tasks/sync/relocate-core-remaining-modules.md

@@ -0,0 +1,56 @@
+---
+id: relocate-core-remaining-modules
+name: Relocate Config, Logger, and Crypto to Hub
+status: completed
+depends_on: [delete-replaced-core-code]
+scope: moderate
+risk: medium
+impact: component
+level: implementation
+---
+
+## Description
+
+Move the three remaining modules from `packages/core/` into `packages/hub/`, then remove the `packages/core/` package entirely. These modules are hub-specific concerns:
+
+- **`config/types.ts`** (169 lines) — TypeBox schemas for HubConfig, SpokeConfig, BaseConfig, PostgresConfig, RedisConfig, etc. Both hub and spoke need config types. For now, these go into hub; if spokes need shared config types later, we can extract them into a thin `@alkdev/config` or inline them in the spoke package.
+- **`logger/mod.ts`** (27 lines) — Logtape wrapper. Currently a stub (only logs `["logtape", "meta"]` category). Needs proper configuration — that's a hub startup concern.
+- **`utils/crypto.ts`** (119 lines) — AES-256-GCM encryption/decryption, PBKDF2 key derivation, key generation. Hub-only (encryption key management lives in the hub).
+
+After relocating, `packages/core/` is empty and should be removed from the workspace.
+
+### Steps
+
+1. Create `packages/hub/src/config/` directory and move `config/types.ts` there
+2. Create `packages/hub/src/logger/` directory and move `logger/mod.ts` there
+3. Create `packages/hub/src/utils/` directory and move `utils/crypto.ts` there
+4. Update all imports in moved files (they'll use `@alkdev/typebox` etc. from npm)
+5. Add `packages/hub/deno.json` with proper dependencies
+6. Update `packages/hub/mod.ts` to export the new modules
+7. Remove `packages/core/` entirely
+8. Remove `"packages/core"` from root `deno.json` workspace array
+9. Verify `deno check packages/hub/` passes
+
+### Note on SpokeConfig
+
+SpokeConfig types are used by spokes, but for now the spoke package can duplicate the small number of fields it needs (SpokeConfig is just hub.url + hub.auth.tokenFile). When we implement the spoke, we'll decide whether to:
+- A) Duplicate the few spoke-relevant fields in the spoke package
+- B) Create a thin shared `@alkdev/config` npm package
+- C) Have the spoke import hub's config types (not ideal, creates coupling)
+
+This decision can be deferred until spoke implementation begins.
+
+## Acceptance Criteria
+
+- [ ] `packages/hub/src/config/types.ts` exists with config TypeBox schemas
+- [ ] `packages/hub/src/logger/mod.ts` exists with logtape wrapper
+- [ ] `packages/hub/src/utils/crypto.ts` exists with AES-256-GCM functions
+- [ ] `packages/hub/deno.json` has correct dependencies and exports
+- [ ] `packages/core/` directory is deleted
+- [ ] Root `deno.json` workspace no longer includes `packages/core`
+- [ ] `deno check packages/hub/` passes
+- [ ] No references to `@alkhub/core` or `packages/core` remain in the codebase
+
+## References
+
+- docs/reviews/core-library-extraction-sync-2026-05-18.md (Section 1.2, 1.3, 6.1, 6.2)