feat: nodes apply the content blocklist in their public groups

A node hosting a public group syncs the hub's blocklist on every
connection (paged, node token only) and applies pushed changes. A
blocked file leaves the index and is refused (content_blocked); private
groups are untouched. The unused per-hash check route is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/deps.py b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
index 42f4101..2fd8b99 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/deps.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/deps.py
@@ -90,6 +90,17 @@ async def require_user_scope(
     return current_user
 
 
+async def require_node_scope(
+    payload: dict = Depends(_decode_token),
+    current_user: User = Depends(get_current_user),
+) -> User:
+    """Only a node daemon's own token — for what a node fetches on its own behalf."""
+    if payload.get("scope") != "node":
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
+                            detail="Node token required")
+    return current_user
+
+
 def user_is_admin(user: User) -> bool:
     """Admin by DB role or by the config allow-list. Use inside a handler that
     already depends on `require_moderator` but has to draw the admin line for