hub package

Package hub exposes safe, read-only views over boards2's persistent state. The Get* functions are crossing functions: callers must invoke them with `cross` (e.g. `hub.GetBoard(cross, id)`). The crossing into hub gives each call a live `cur` whose `Previous()` is the caller's realm — that's what boards2's protected entry points use for the namespace check.

Note for future maintainers: inside a Get* body, `cur.Previous()` is the *immediate* caller's realm, which may be an intermediary, not necessarily the end user. Do not graft user-identity gating onto these reads.