refactor(node): JSON-only control API, Node page absorbs the admin dashboard

Remove the node daemon's server-rendered admin UI (GET / and /audit, the
_render_* helpers and inline templates) and the `meshbay-node ui` CLI verb.
The loopback control API stays; it is now JSON only, ruff-clean, and 453
lines (was 1074). Also drop three never-wired endpoints (/api/config,
/api/chat/history, /ws/chat, plus broadcast_chat) and the pointless
18000/tcp firewall profiles.

The desktop client's Node page (static/node-page.js) takes over what the
dashboard showed, reorganised into six tabs (Overview, Groups, Roster,
Peers, Audit, Settings):
- Overview: version, node id, QUIC port, hub, index-cache maintenance
- Roster: node-wide view with unpin
- Peers and Audit: auto-load on open, no Load button
- Audit: real usernames and group names (resolved from the roster and
  node.toml), Previous/Next pagination newest-first, Export CSV of every
  matching row
- Settings: node settings, STUN, ICE, denylist, then Unlink from hub

Backend: audit.get_entries gains `offset`; /api/audit and /api/peers
resolve ids to names via a new _display_names helper; CSP tightened to
default-src 'none' now that no HTML is served. draft-v6 sections 2.11 and
2.12 corrected -- the Node page uses the loopback API, not MNP.

One capability is intentionally dropped: browser-based admin on a headless
server. The CLI covers every operation there.

See docs/refactor-node-ui.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MQCaZnde4Bjjdu84dhSuF5

1 files changed, 10 insertions, 16 deletions

diff --git a/man/meshbay-node.1 b/man/meshbay-node.1
index 2ce1b58..1e1173b 100644
--- a/man/meshbay-node.1
+++ b/man/meshbay-node.1
@@ -15,14 +15,14 @@ meshbay\-node \- MeshBay Node daemon, local file host, streaming server, and gro
 .B meshbay\-node
 is the local daemon of the MeshBay decentralized platform.
 It hosts shared directories, indexes files, serves video streams to peers,
-manages group membership, and provides a local admin web UI.
+manages group membership, and provides a local control API.
 .PP
 When invoked without a command, the daemon starts in the foreground.
 It loads its configuration from
 .IR ~/.config/meshbay/node.toml ,
 unlocks (or creates) its Ed25519 keystore, connects to the hub,
 starts the directory indexer, the QUIC chunk server,
-the WebRTC transport, and the local admin UI.
+the WebRTC transport, and the local control API.
 .PP
 The daemon runs until interrupted by
 .B SIGINT
@@ -44,12 +44,6 @@ configured groups and their roots, operator pairing status, and pending
 invitations. Works whether the daemon is running or stopped.
 .
 .TP
-.B ui
-Print the URL of the local admin web UI, including the session token.
-The UI listens on loopback only; use SSH port forwarding to access it
-from another machine.
-.
-.TP
 .B calibrate\-argon2
 Benchmark Argon2id with several memory cost values and suggest the one
 closest to a 500\ ms target on the current hardware.
@@ -261,7 +255,7 @@ Override:
 .
 .TP
 .B ui_port
-Local admin web UI port (bound to 127.0.0.1 only). Default:
+Local control API port (loopback only, token\-gated). Default:
 .BR 18000 .
 .
 .TP
@@ -478,13 +472,14 @@ Encrypted Ed25519 + X25519 keystore, protected by Argon2id.
 .TP
 .I ~/.local/share/meshbay/
 Data directory: chat databases, index caches, bundle store, roster,
-denylist, and the UI session token.
+denylist, and the control API session token.
 .
 .TP
 .I ~/.local/share/meshbay/ui\-token
-Per\-run token for the local admin UI. Written by the daemon at startup
-and read by
-.BR "meshbay\-node ui" .
+Per\-run token for the local control API. Written by the daemon at startup
+and read by the
+.B meshbay\-node
+CLI and the desktop client's Node page.
 .
 .SH SYSTEMD INTEGRATION
 A user service unit is provided at
@@ -516,10 +511,9 @@ and supports
 .
 .SH SECURITY
 .IP \(bu 2
-The admin UI binds to
+The control API binds to
 .B 127.0.0.1
-only and is protected by a per\-run token. Use SSH port forwarding for
-remote access.
+only and is protected by a per\-run token.
 .IP \(bu 2
 Operator authority is established locally via
 .BR "meshbay\-node operator pair" ,