feat(node): full Node admin panel — CLI parity, hot-reload, group lifecycle

Node admin panel (NodePage) now covers every CLI operation over MNP:
group attach/detach, roster, member unpin, GEK rotate, denylist, reload.

Daemon hot-loads new groups and tears down removed ones on config reload
instead of requiring a full restart. Group attach/detach via MNP or
local API triggers an automatic reload so the group is live immediately.

Fixed GroupPage hang on first visit to a newly created group: the JWT
issued at login didn't include the new group, the node rejected with
not_a_member, and the token-refresh path returned without re-triggering
the connect effect (Boolean(token) didn't change). Now bumps retryKey
after a successful refresh so the effect re-runs with the fresh token.

NodePage marks groups hosted by the node but absent from the hub with a
"not on hub" badge so stale groups are visible and easy to remove.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2 files changed, 22 insertions, 0 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py
index a793471..73f07d9 100644
--- a/packages/meshbay-common/src/meshbay_common/adminop.py
+++ b/packages/meshbay-common/src/meshbay_common/adminop.py
@@ -49,6 +49,10 @@ OP_MEMBER_UNPIN = "member_unpin"
 # setting decides who may write to the operator's disk, so a node that took it
 # from an unsigned message would let any member re-enable it for everyone.
 OP_MEMBER_UPLOAD = "member_upload"
+OP_ROOT_ADD = "root_add"
+OP_ROOT_REMOVE = "root_remove"
+OP_GROUP_ATTACH = "group_attach"
+OP_GROUP_DETACH = "group_detach"
 # OP_GEK_BUNDLE_STORE is gone. Members no longer hand the node key material at
 # all: the node holds the GEK and wraps it itself, for a key the recipient proved
 # they hold (see `join.py` and docs/invite-pairing-v1.md). The operation existed
diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py
index 1c6dd3e..06acb8b 100644
--- a/packages/meshbay-common/src/meshbay_common/protocol.py
+++ b/packages/meshbay-common/src/meshbay_common/protocol.py
@@ -97,6 +97,24 @@ class MNP:
     GEK_ROTATE           = "gek_rotate"            # operator → node: new group key
     GEK_ROTATE_ACK       = "gek_rotate_ack"
     INVITE_RESULT        = "invite_result"         # node → operator: the code, once
+    NODE_STATUS          = "node_status"           # operator → node: list all groups + roots
+    NODE_STATUS_ACK      = "node_status_ack"       # node → operator: full status
+    ROOT_ADD             = "root_add"              # operator → node: add a directory to a group
+    ROOT_ADD_ACK         = "root_add_ack"          # node → operator: confirmed
+    ROOT_REMOVE          = "root_remove"           # operator → node: remove a root from a group
+    ROOT_REMOVE_ACK      = "root_remove_ack"       # node → operator: confirmed
+    ROSTER_READ          = "roster_read"            # operator → node: list pinned identities + members
+    ROSTER_READ_ACK      = "roster_read_ack"
+    DENYLIST_READ        = "denylist_read"          # operator → node: show denylist entries
+    DENYLIST_READ_ACK    = "denylist_read_ack"
+    DENYLIST_CLEAR       = "denylist_clear"         # operator → node: remove denylist entry(ies)
+    DENYLIST_CLEAR_ACK   = "denylist_clear_ack"
+    GROUP_ATTACH         = "group_attach"           # operator → node: host a new group
+    GROUP_ATTACH_ACK     = "group_attach_ack"
+    GROUP_DETACH         = "group_detach"           # operator → node: stop hosting a group
+    GROUP_DETACH_ACK     = "group_detach_ack"
+    NODE_RELOAD          = "node_reload"            # operator → node: re-read node.toml
+    NODE_RELOAD_ACK      = "node_reload_ack"
 
 
 # ── Index entry ───────────────────────────────────────────────────────────────