feat: unified group management, public groups, and activity-based sidebar

Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces
into a single multi-step page: group creation on hub, node attachment, root
selection via folder picker, GEK initialization, and auto-pairing — all in one
flow. Browser SPA keeps its current behavior unchanged.

Public group support (Option A — GEK for all groups):
- All groups have GEK regardless of visibility; open-join groups auto-admit
  via TOFU when join_policy is "open"
- Key rotation blocked for public groups (API guard + UI hidden)
- Hub signaling allows WebRTC offers for nodes hosting open-join groups even
  when the caller isn't a member yet
- attach_group writes join_policy to node.toml
- Daemon loads GEK for all groups, not just private ones
- Known-device path in join_request now auto-admits to open-join groups

Node loopback API bridge (Electron IPC):
- node:detect, node:call, node:pairing-code IPC handlers in main process
- Renderer never sees tokens, paths, or keys (session token = physical access)
- platform.js node namespace for UI consumption
- Loopback endpoints: roots CRUD, member-upload toggle, reload

Bug fixes:
- Root change detection: removed premature ctx["roots"] updates from add_root
  and remove_root that prevented indexer retarget on reload
- Duplicate offline message: global fallback now gated on !group
- Signaling membership check: fallback to open-join groups for non-members

Sidebar groups sorted by last_activity_at (most recent first):
- New Group.last_activity_at column with Alembic migration
- POST /v1/groups/{id}/activity endpoint, called on connect and chat send
- Client-side sort + throttled hub updates (1/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/packages/meshbay-client/src/preload.js b/packages/meshbay-client/src/preload.js
index e3af68f..04dfe44 100644
--- a/packages/meshbay-client/src/preload.js
+++ b/packages/meshbay-client/src/preload.js
@@ -80,6 +80,16 @@ contextBridge.exposeInMainWorld('meshbay', {
     choose: () => ipcRenderer.invoke('root:choose'),
   },
 
+  // The local node, if one is running. The renderer never sees the session
+  // token — it names an operation and the main process executes it, the same
+  // pattern as hub:fetch.
+  node: {
+    detect: () => ipcRenderer.invoke('node:detect'),
+    call: (method, path, body) => ipcRenderer.invoke('node:call', method, path, body),
+    pairingCode: () => ipcRenderer.invoke('node:pairing-code'),
+    setPairingCode: (code) => ipcRenderer.invoke('node:set-pairing-code', code),
+  },
+
   // A sink that writes to disk as chunks arrive, never a buffer handed over at
   // the end. `auto` uses the remembered folder without a dialog, which is what
   // "save automatically" means; without one, or when the person asked to be