fix: only the owner decides who hosts a group, and nobody is made a member unasked

- hub: a node may host a group only if its account owns it or the owner
  approved that node (new `group_hosts`). Membership was the ceiling, and
  every member holds the group key, so any member's node could register as a
  host and be the one clients kept. A node claiming a group it may not host
  is recorded as a request; the owner is notified once and approves or
  refuses it (GET/POST/DELETE /v1/groups/{id}/hosts[/{node_id}]), which
  takes effect on a connected node at once.
- hub: an owner adding a username creates an invitation (new
  `group_invitations`), accepted or declined by the invitee
  (/v1/groups/invitations, /{id}/invitation/accept|decline). Until then the
  group is not listed, not dialled, not searched and not in any token.
  Invitation links, open joins and group creation still make members
  directly: they are the account's own act.
- hub: the MNP token names only the group it is minted for (group_id is now
  required), so a node operator no longer learns a member's other groups.
- SPA: invitations on the home page; invited people and host requests in
  the group's settings; the transport sends group_id. Ten catalogues.
- Browser probes for both screens, run in Chrome and Firefox.
- Design §5.2, §7.2, §7.3, AV32, AV33; protocol §6.3; user guide.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 16 insertions, 5 deletions

diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index fc9cf40..a802ae1 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -212,7 +212,9 @@ Someone who runs a node invites you. You need an account on the same hub first.
 1. **They send you a code** — eight characters like `K7P2-9WQX`, by message,
    mail, or read out loud. It is good for 7 days by default, works once, and
    only for your account in that one group.
-2. **You sign in**, and the group is already in your sidebar.
+2. **You sign in**, and the group is waiting under **Invitations** on your
+   home page. **Accept** it — until you do, nothing connects to it — and it
+   joins your sidebar. **Decline** if you did not expect it.
 3. **You open it.** It says *"This node needs to recognise you"*. Paste the
    code.
 4. Done — the machine hosting the group recognises you from now on, and the
@@ -566,10 +568,19 @@ meshbay-node member invite alice_dupont
 
 Or the group's **Members** tab, from a paired browser.
 
-They need an account on the same hub first. The invitation registers their
-membership on the hub and produces a code that never goes near it. Send the
-code out of band; they enter it the first time they open the group. You do not
-need to be online then.
+They need an account on the same hub first. The invitation appears on their
+home page, where they accept it, and produces a code that never goes near the
+hub. Send the code out of band; they enter it the first time they open the
+group. You do not need to be online then.
+
+### Other nodes hosting your group
+
+Your own nodes serve your groups without asking. Any other node — a member's,
+say, offering a second copy — serves one of your groups only after you approve
+it: it appears in the group's settings under **Hosts**, and you are notified
+the first time it asks. **Approve** or **Refuse**; either can be changed later.
+A member's node holds the same group key as everyone, so a node you did not
+approve could otherwise present itself to your members as the group's host.
 
 **Inviting someone who has no account yet** is a link: