feat(node): CLI for headless operators — status, ui, gek-init

Every operator action lived behind a web UI on the node's own loopback
interface. For the normal deployment — a node on a server reached over SSH —
that is unusable: no browser on the host, and 11.5.3 added a per-run token that
had to be copied out of a log to get in.

  status    hub, node public key, daemon state, groups, admin-key pinning.
            Reads the keystore directly so it works while the daemon is STOPPED,
            which is exactly when it is needed: the daemon cannot stay up before
            its key is linked or before a group exists.
  ui        prints the URL and the ssh -L line. It does not open a browser —
            that was an assumption about the environment, and a wrong one.
  gek-init  initialises a group key through the daemon's loopback API. Same
            operation as the admin UI button, no browser involved.

Also fixes a latent bug in QE/deploy/deploy-node.sh: the pkill pattern was
unanchored, so it matched any shell whose command line merely mentioned the
daemon — including the one running the script. It killed a session three times
before being pinned down. Anchored to the end of the command line.

Verified against the live deployment. grenet and cbesson both connect over
WebRTC through real NAT and can browse, download, stream, upload and chat. The
node audit log confirms the security properties in production: uploads land in
.uploads/{user_id}/ (C5a), the invite required the operator's signature over an
admin transcript (C5b, H5), the pre-proof bundle window is bounded and audited
(C4), and a non-member handshake was refused.

Docs updated: Phase 14 marked partially delivered with the reason, draft-v5 §5.3
records the two operator personas, QE/deploy/README.md documents the commands
and the remaining browser-only gaps (invite, delete).

Tests: 121 node.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions