refactor(node): JSON-only control API, Node page absorbs the admin dashboard

Remove the node daemon's server-rendered admin UI (GET / and /audit, the
_render_* helpers and inline templates) and the `meshbay-node ui` CLI verb.
The loopback control API stays; it is now JSON only, ruff-clean, and 453
lines (was 1074). Also drop three never-wired endpoints (/api/config,
/api/chat/history, /ws/chat, plus broadcast_chat) and the pointless
18000/tcp firewall profiles.

The desktop client's Node page (static/node-page.js) takes over what the
dashboard showed, reorganised into six tabs (Overview, Groups, Roster,
Peers, Audit, Settings):
- Overview: version, node id, QUIC port, hub, index-cache maintenance
- Roster: node-wide view with unpin
- Peers and Audit: auto-load on open, no Load button
- Audit: real usernames and group names (resolved from the roster and
  node.toml), Previous/Next pagination newest-first, Export CSV of every
  matching row
- Settings: node settings, STUN, ICE, denylist, then Unlink from hub

Backend: audit.get_entries gains `offset`; /api/audit and /api/peers
resolve ids to names via a new _display_names helper; CSP tightened to
default-src 'none' now that no HTML is served. draft-v6 sections 2.11 and
2.12 corrected -- the Node page uses the loopback API, not MNP.

One capability is intentionally dropped: browser-based admin on a headless
server. The CLI covers every operation there.

See docs/refactor-node-ui.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MQCaZnde4Bjjdu84dhSuF5

1 files changed, 22 insertions, 7 deletions

diff --git a/docs/meshbay-draft-v6.md b/docs/meshbay-draft-v6.md
index bee2f77..2f2d5c7 100644
--- a/docs/meshbay-draft-v6.md
+++ b/docs/meshbay-draft-v6.md
@@ -19,6 +19,11 @@
 > browser and node, configurable on the node side (Node page, CLI, `node.toml`); ICE
 > interface filtering exposed on the Node page. See §1 row 15 and §2.12.
 >
+> **Amended 2026-09-01**: §2.11/§2.12 corrected to match what was built — the Node page
+> reaches the daemon over its token-gated loopback HTTP API, not MNP. The MNP `node_*`
+> message types remain, unused, for a possible future browser-only path. See
+> `docs/refactor-node-ui.md`.
+>
 > The v5 convention is carried forward and is not negotiable: **a claim in this document
 > must name the adversary it holds against.** A property that holds against a passive hub
 > and not an active one is written that way.
@@ -370,8 +375,8 @@ pinning the checked IP — deferred.
 
 ### 2.11 Node page — `[node]` settings exposed to the operator
 
-New. The Node page (D5) connects over MNP and shows groups, roots and the roster;
-it does not show the daemon's own tuning. Five `[node]` settings from `node.toml`
+New. The Node page (D5) shows groups, roots and the roster; it does not show the
+daemon's own tuning. Five `[node]` settings from `node.toml`
 are worth surfacing there — they affect what the node does, not only how it starts,
 and their current value is invisible until something goes wrong (an invitation that
 expired silently, a viewer told "server busy" with no knob to turn).
@@ -392,10 +397,19 @@ read as today; if `roster.db` holds an override for a key, it takes precedence.
 line replacement (the same technique `ops.py` uses for roots), not a round-trip through a
 writer — comments and formatting survive.
 
-**Wire shape.** `node_status_ack` gains a `settings` object carrying the five values above
-(effective, i.e. roster override if present, config default otherwise). `node_settings_set`
-writes changes and returns `node_settings_set_ack` with the updated keys. Both are
-operator-only.
+**Transport — the loopback API, not MNP.** The Node page talks to the daemon over its
+token-gated `127.0.0.1` HTTP API (`GET`/`PUT /api/node-settings`), the same API the CLI
+uses. `GET` returns the five effective values (roster override if present, config default
+otherwise); `PUT` writes changes and returns the updated keys. Both require the per-run
+session token, which the desktop client's main process reads from the daemon's data
+directory and the renderer never sees.
+
+An earlier draft of this section specified an MNP path (`node_status_ack` carrying a
+`settings` object, `node_settings_set` / `node_settings_set_ack`). Those message types
+exist in `protocol.py` and are handled in `webrtc_server.py`, but the Node page does not
+use them: the loopback API needs no signaling round-trip, no GEK and no joined group, and
+works while the node is still starting. The MNP handlers are reserved for a possible
+future browser-side (no desktop client) path. See `docs/refactor-node-ui.md`.
 
 ### 2.12 WebRTC transport — STUN fallbacks and ICE interface filtering
 
@@ -423,7 +437,8 @@ other used.
 (`meshbay-node stun list|add|remove|reset`), and `node.toml` (`stun_servers` under
 `[node]`). Persistence follows the §2.11 pattern: `roster.db` for immediate effect,
 `node.toml` so the value survives a DB wipe, roster override wins on startup. The live
-transport's STUN list is hot-swapped on save — no restart.
+transport's STUN list is hot-swapped on save — no restart. The Node page reaches these
+settings over the loopback API described in §2.11, not MNP.
 
 **Browser-side: hardcoded, not configurable.** The browser's `iceServers` array is set in
 `transport.js`, shipped by the hub. No mechanism exists for a node to push STUN