feat(cli): meshbay-cli, a command-line client for members

Signs in to the hub, lists the account's groups and their folders, and
downloads and uploads files directly with each group's node, end-to-end
encrypted. With no argument it opens a two-pane interactive mode (Textual).
Session and device keys are kept encrypted under the system's key storage,
or a 0600 key file where there is none; node keys are pinned at first
contact; a new machine links as a device.

Packaged on its own on Linux (deb and rpm, on meshbay-common's venv, with a
man page generated from the parser) and frozen next to meshbay-node in the
full Windows installer, not the light one, with a self-test the build runs.
client/keys.py ports keyderive.js and is LGPL like it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/README.md b/README.md
index 3c4cbd1..e983aa9 100644
--- a/README.md
+++ b/README.md
@@ -41,10 +41,11 @@ feature, and they are off on the reference deployment, [meshbay.org](https://mes
 | `packages/meshbay-common/` | Shared cryptography and protocol types |
 | `packages/meshbay-hub/` | Hub server (FastAPI + PostgreSQL) and the web client it serves |
 | `packages/meshbay-node/` | Node daemon, its CLI and its local control UI |
+| `packages/meshbay-cli/` | Command-line client: a member's groups and files from a terminal |
 | `packaging/` | `.deb`, `.rpm` and Windows packaging, systemd units, Caddy and firewall configuration |
 | `docs/` | Design specification, protocol, HTTP API, user and operator guides |
 | `examples/` | Small Python programs using the hub, a node and its control API |
-| `man/` | Manual page for `meshbay-node` |
+| `man/` | Manual page for `meshbay-node` (`meshbay-cli`'s is generated from its parser at build time) |
 | `site/` | Static website pages (not deployed) |
 | `poc/` | Early proof-of-concept scripts, kept for reference |
 
@@ -57,7 +58,7 @@ Python 3.12 or later. All dependencies are declared in the packages'
 python3 -m venv .venv
 source .venv/bin/activate
 pip install -e "packages/meshbay-common[dev]" -e "packages/meshbay-hub[dev]" \
-            -e "packages/meshbay-node[dev]"
+            -e "packages/meshbay-node[dev]" -e "packages/meshbay-cli[dev]"
 .venv/bin/pytest
 ```
 
@@ -68,8 +69,8 @@ MeshBay is free software.
 | Component | Licence |
 |---|---|
 | `packages/meshbay-common/` — the protocol and its cryptography, in Python | [LGPL-3.0-or-later](packages/meshbay-common/COPYING.LESSER) (with the [GPL-3.0](packages/meshbay-common/COPYING) it builds on) |
-| The same layer in the clients: the files marked `SPDX-License-Identifier: LGPL-3.0-or-later` — in the interface, `keyderive.js`, `crypto.js`, `playlist-crypto.js`, `transport.js` and `transport-*.js`; on the desktop, `keyring.js`, `transcripts.js` and `argon2-wasm.js`; on Android, `keys/Kdf.kt`, `keys/Keyring.kt` and `keys/Transcripts.kt` | LGPL-3.0-or-later |
-| Everything else — hub, node, the rest of the interface, the desktop and Android shells | [AGPL-3.0-or-later](LICENSE) |
+| The same layer in the clients: the files marked `SPDX-License-Identifier: LGPL-3.0-or-later` — in the interface, `keyderive.js`, `crypto.js`, `playlist-crypto.js`, `transport.js` and `transport-*.js`; on the desktop, `keyring.js`, `transcripts.js` and `argon2-wasm.js`; on Android, `keys/Kdf.kt`, `keys/Keyring.kt` and `keys/Transcripts.kt`; in the command-line client, `client/keys.py` | LGPL-3.0-or-later |
+| Everything else — hub, node, command-line client, the rest of the interface, the desktop and Android shells | [AGPL-3.0-or-later](LICENSE) |
 
 The line is the protocol. Whatever a program needs to speak to a hub and a node —
 key derivation, the identity bundle, sealing and opening, what is signed, the