feat: add fail-closed Hub access profile foundation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

hub_core/runtime/compat.py

@@ -548,6 +548,10 @@ async def _protected(
     _enabled(request, group)
     if write and group not in request.app.state.settings.v2_write_groups:
         raise HTTPException(status_code=503, detail="compatibility group is read-only")
+    if request.app.state.settings.enforce_access:
+        if getattr(request.state, "hub_access", None) is None:
+            raise HTTPException(status_code=503, detail="access boundary unavailable")
+        return
     if not authorization or not authorization.startswith("Bearer "):
         raise _unauthorized("Missing bearer token")
     token = authorization.removeprefix("Bearer ").strip()