feat(hub): let a hub admin disable public groups instance-wide

A new General tab in Administration carries one switch, allow_public_groups,
stored in a hub_settings key/value table (runtime-editable, unlike hub.toml).
Default is on; an absent row means on, so an upgrade changes nothing.

Enforcement is server-side on every hub-mediated path, not just the SPA:

  - create_group        refuses visibility=public (403), staff included
  - list_public_groups  the directory returns nothing (local + federated)
  - join_group          open-joining a public group is refused
  - group_online_nodes  a non-member of a public group is handed no node
  - signaling.webrtc_offer  drops the "node hosts an open group" fallback
  - federation.export_directory  advertises nothing to peer hubs

The switch is read live, so flipping it back restores every path. Existing
members of a group that predates the switch keep their membership row and
their access — this is plan A, not a purge. GET /v1/hub/info exposes the
flag (unauthenticated) so the create-group form and the sidebar's "Public
groups" link render correctly.

Also in the admin Groups tab: a Revoke action beside Suspend. Suspend is the
reversible hub flag; Revoke calls POST /v1/admin/revoke, which sets
status=revoked and broadcasts a signed revocation every node enforces
(denylist + dropped live sessions). It is confirm-guarded and names the group.

And a message fix the revoke work surfaced: group_online_nodes, join_group and
webrtc_offer answered "Group is suspended" for any non-active status. They now
report the real state, so a member of a revoked group is told "Group is
revoked" rather than something reversible-sounding.

Tests: test_public_groups_toggle.py (10) covers the switch end to end and the
five enforcement paths; test_revocation.py gains the status-message assertion.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

1 files changed, 50 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
index 7ee05ca..4141c79 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
@@ -18,6 +18,7 @@ from meshbay_hub.api.deps import require_admin, require_moderator
 from meshbay_hub.api.revocation import get_connected_node_count, is_node_connected
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User
+from meshbay_hub import hub_settings
 
 log = logging.getLogger(__name__)
 
@@ -35,6 +36,55 @@ class GroupPatchRequest(BaseModel):
     status: str | None = None
 
 
+class SettingsPatchRequest(BaseModel):
+    allow_public_groups: bool | None = None
+
+
+# ── Instance settings ────────────────────────────────────────────────────────
+
+def _settings_payload(allow_public_groups: bool) -> dict:
+    return {"allow_public_groups": allow_public_groups}
+
+
+@router.get("/settings")
+async def admin_get_settings(
+    current_user: User = Depends(require_moderator),
+    db: AsyncSession = Depends(get_db),
+):
+    """Instance-wide policy an admin controls from the panel. Moderators may read."""
+    return _settings_payload(await hub_settings.public_groups_allowed(db))
+
+
+@router.patch("/settings")
+async def admin_patch_settings(
+    body: SettingsPatchRequest,
+    current_user: User = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    """
+    Change instance policy. Admin only — moderators get the read above.
+
+    The enforcement lives where the thing being restricted happens (public-group
+    creation is refused in `groups.create_group`), so flipping this here is the
+    whole change: a client that keeps drawing the option still cannot use it.
+    """
+    if body.allow_public_groups is not None:
+        await hub_settings.set_raw(
+            db, hub_settings.ALLOW_PUBLIC_GROUPS,
+            "true" if body.allow_public_groups else "false")
+        log.info("Instance setting allow_public_groups=%s by %s",
+                 body.allow_public_groups, current_user.username)
+        db.add(IPLog(
+            user_id=current_user.id,
+            event="admin_settings_update",
+            ip_address="admin",
+            detail=f"allow_public_groups={body.allow_public_groups}",
+        ))
+        await db.commit()
+
+    return _settings_payload(await hub_settings.public_groups_allowed(db))
+
+
 # ── Stats ────────────────────────────────────────────────────────────────────
 
 @router.get("/stats")