feat(client): pin node identities on first use — closes 11.5.8

The client verified the node's Ed25519 signature but did not remember which key
it had seen, so a substituted node was caught only by its lack of the GEK.

Trust On First Use: the node's public key is recorded per node_id on the first
successful handshake and compared on every later one. A change is refused
outright — strict, per operator decision. A warning users can click through is
decorative, and this is the SSH known-hosts tradeoff taken deliberately.

Scope, stated honestly: with C6 closed this is defence in depth, not the primary
control. A substituted node already fails the GEK proof. Pinning covers the case
where an attacker HAS the group key — an ex-member, or a leaked GEK — and swaps
the node underneath, which the proof alone cannot distinguish from the real one.

Strict refusal needs an escape hatch or it is a dead end: a node operator who
reinstalls and loses their keystore generates a new pk_node and would otherwise
lock out every member. Settings gains a "Node identities" section showing the
pin count and clearing them, with copy telling the user to verify out of band
first. Also exposed as MeshBayTransport.clearNodePin() for the native client.

Tests: hub+common green; all five static JS files syntax-checked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions