REUSE-WP-0019-T04: reuse telemetry store and recording

Implements the hub side of the shared reuse-event schema (already drafted
in WP-0018-T01, schemas/reuse-event.schema.json): a SQLite reuse_events
table, POST /v1/reuse-events (token-auth), GET /v1/reuse-events?capability_id=
(read-only).

reuse_surface/plan_check.py: refactored record_outcome around a new
shared post_or_fallback_reuse_event() helper -- tries the hub first, falls
back to the local JSONL only on failure/unreachability, never both. New
record_manual_reuse_event() backs a new CLI command, reuse-surface
record-reuse, for retroactive facts recorded outside plan-check.

Privacy/scope (repo slugs and capability ids only, no code, no secrets) is
enforced structurally via the schema's additionalProperties: false, not
just by convention.

21 new pytest cases, 145 total pass. Live-verified against a real running
hub instance: POST/GET /v1/reuse-events directly, record-reuse and
plan-check --record-outcome both posting successfully to the hub, and --
after actually killing the hub process -- confirmed the fallback path
writes correctly to the local JSONL instead of erroring.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

reuse_surface/hub_client.py

@@ -83,4 +83,27 @@ def hub_update(
         f"{service_base_url(base_url)}/v1/repos/{repo}",
         token=token,
         body=payload,
-    )
+    )
+
+
+def hub_record_reuse_event(
+    payload: dict[str, Any], base_url: str | None = None
+) -> tuple[int, Any]:
+    token = service_token()
+    if not token:
+        raise ValueError("REUSE_SURFACE_TOKEN is required for record-reuse")
+    return _request(
+        "POST",
+        f"{service_base_url(base_url)}/v1/reuse-events",
+        token=token,
+        body=payload,
+    )
+
+
+def hub_list_reuse_events(
+    capability_id: str | None = None, base_url: str | None = None
+) -> tuple[int, Any]:
+    url = f"{service_base_url(base_url)}/v1/reuse-events"
+    if capability_id:
+        url += f"?capability_id={capability_id}"
+    return _request("GET", url)