docs: update all pointers after keyderive + QE restructure

CLAUDE.md: add QE/ to structure, key modules table, server state reference,
security rule updated (QE/ not keypair files), meshbay.org inventory pointer.

devel-phases.md: add milestones 6.6-6.9 (keyderive, bundle, demo scripts,
QUICKSTART rewrite). 81/81 tests.

docs/meshbay-draft-v3.md §6.1.1: new section documenting 3 key generation
strategies (Argon2id CLI, WebCrypto browser+bundle, keystore file) and the
algorithm mismatch caveat between CLI and web registration paths.

docs/USERGUIDE.md §2 Register+Login: replace "generate and persist before
registering" warning with the two clean strategies (derive_keys_from_password
for CLI, keyderive.js + keypair_bundle for browser). Login response updated
with keypair_bundle field.

hub/models.py + users.py + Alembic migration: keypair_bundle column on User,
stored at registration, returned at login (web clients only).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 31 insertions, 8 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 3f05a06..306cad3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -14,9 +14,18 @@ meshbay/
 │   ├── meshbay-hub/      # Hub server (FastAPI + PostgreSQL) — meshbay-hub RPM
 │   └── meshbay-node/     # Node daemon + local UI — meshbay-node RPM
 ├── poc/                  # POC spike scripts (reference, not production)
-└── docs/                 # Architecture drafts and POC plans
+├── docs/                 # Architecture drafts and POC plans
+├── packaging/            # RPM spec files, DEB control files, systemd units
+└── QE/                   # NOT versioned (.gitignore) — test artefacts, credentials, demos
+    ├── demo-v1/          #   Scripts démo opérationnels (setup_demo.py, run_node.py, download.py)
+    ├── spikes/           #   Expérimentations futures (remplace ~/draft/)
+    └── server-state/     #   Inventaire de ce qui tourne sur meshbay.org
 ```
 
+**Règle QE/** : tout test sur meshbay.org doit ouvrir le port UFW, tester, et
+fermer le port + tuer les processus dans le MÊME bloc de commandes.
+Jamais de processus orphelins ni de ports ouverts après un test.
+
 ## Python environment
 
 - **Minimum Python:** 3.12
@@ -75,20 +84,34 @@ Scope: `hub`, `node`, `common`, or omitted for cross-cutting
 ## Security rules
 
 - **Never commit private keys** (hub_private.pem, *.key, unlock.key, keystore.enc)
-- **Never commit node_state.json or bob_state.json** (contain private key material)
+- **Never commit QE/** — credentials, test keys, demo data go there
 - **Never log GEK, private keys, or plaintext passwords** — even at DEBUG level
-- **meshbay.org is internet-facing** — kill all test processes after spikes, close test UFW ports
+- **meshbay.org is internet-facing** — open port → test → close port + kill processes in same block
 
 ## Known calibration TODOs
 
 - Argon2id `memory_cost`: currently 65536 (64 MB, 78ms) — increase to 262144 (256 MB) before prod
   to target ~500ms on typical home server hardware. Implement a `calibrate` CLI command.
 
-## meshbay.org server
+## Key modules — où trouver quoi
+
+| Besoin | Module | Fichier |
+|---|---|---|
+| Chiffrement chunks (prod) | `meshbay_common.crypto` | `crypto.py` |
+| Dérivation clés depuis password | `meshbay_common.keyderive` | `keyderive.py` |
+| Bundle clés (web) | `meshbay_common.keyderive` | `keyderive.py` + `static/keyderive.js` |
+| GEK wrap/unwrap (ECIES) | `meshbay_common.crypto` | `crypto.py` |
+| Double Ratchet (chat) | `meshbay_common.ratchet` | `ratchet.py` |
+| AES-GCM (navigateur) | `meshbay_common.webcrypto` | `webcrypto.py` + `static/crypto.js` |
+| Keystore node | `meshbay_node.keystore` | `keystore.py` |
+| Scripts de démo opérationnels | — | `QE/demo-v1/*.py` (non versionné) |
+
+## meshbay.org server (état cible)
 
 - OS: Ubuntu 26.04 LTS, Python 3.14.4
 - SSH: `ssh cbesson@meshbay.org`
-- Web proxy: Caddy (to be installed) behind ports 80/443
-- UFW rules: only 22/tcp, 80/tcp, 443/tcp
-- **Always close test ports after spikes** (`sudo ufw delete allow <port>/<proto>`)
-- Hub POC files: `~/meshbay-poc/` (reference only, not production)
+- Caddy : reverse proxy HTTPS sur 80/443
+- UFW rules: **22/tcp, 80/tcp, 443/tcp uniquement**
+- Services légitimes : `meshbay-hub.service`, Caddy, PostgreSQL (local)
+- Inventaire détaillé : `QE/server-state/meshbay.org.md`
+- Deploy hub : voir `QE/server-state/meshbay.org.md`