feat(state): let the hub declare what instance it is

Answering on a port was the only evidence callers had that they had reached
the authoritative hub. A local cache and central both served port 8000,
separated only by IP family, and every default reached the cache for seven
weeks (ADR-010).

Adds instance_role and instance_label, surfaced on /state/health. The default
is "unknown" on purpose: an instance that has not declared itself is not the
primary. Production values declare primary/railiance01; the chart default
stays unknown because a chart can be installed anywhere.

statehub status now prints which instance answered.

Refs CUST-WP-0067-T03

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

api/config.py

@@ -12,6 +12,14 @@ class Settings(BaseSettings):
 
     database_url: str = "postgresql+asyncpg://custodian:changeme@127.0.0.1:5432/custodian"
     api_base: str = "http://127.0.0.1:8000"
+    # What this instance claims to be. Deliberately defaults to "unknown":
+    # an instance that has not declared itself is not the primary, and callers
+    # that need the authoritative hub must be able to tell the difference.
+    # Answering on a port is not evidence of authority — that assumption cost
+    # seven weeks of onboarding (CUST-WP-0067-T03, ADR-010).
+    instance_role: Literal["primary", "cache", "unknown"] = "unknown"
+    # Free-form label to name *which* instance answered, e.g. "railiance01".
+    instance_label: str | None = None
     debug: bool = False
     state_hub_report_dir: str = "reports/recently-on-scope"
     state_hub_markitect_cli_path: str | None = None