feat(hub): let a hub admin disable public groups instance-wide

A new General tab in Administration carries one switch, allow_public_groups,
stored in a hub_settings key/value table (runtime-editable, unlike hub.toml).
Default is on; an absent row means on, so an upgrade changes nothing.

Enforcement is server-side on every hub-mediated path, not just the SPA:

  - create_group        refuses visibility=public (403), staff included
  - list_public_groups  the directory returns nothing (local + federated)
  - join_group          open-joining a public group is refused
  - group_online_nodes  a non-member of a public group is handed no node
  - signaling.webrtc_offer  drops the "node hosts an open group" fallback
  - federation.export_directory  advertises nothing to peer hubs

The switch is read live, so flipping it back restores every path. Existing
members of a group that predates the switch keep their membership row and
their access — this is plan A, not a purge. GET /v1/hub/info exposes the
flag (unauthenticated) so the create-group form and the sidebar's "Public
groups" link render correctly.

Also in the admin Groups tab: a Revoke action beside Suspend. Suspend is the
reversible hub flag; Revoke calls POST /v1/admin/revoke, which sets
status=revoked and broadcasts a signed revocation every node enforces
(denylist + dropped live sessions). It is confirm-guarded and names the group.

And a message fix the revoke work surfaced: group_online_nodes, join_group and
webrtc_offer answered "Group is suspended" for any non-active status. They now
report the real state, so a member of a revoked group is told "Group is
revoked" rather than something reversible-sounding.

Tests: test_public_groups_toggle.py (10) covers the switch end to end and the
five enforcement paths; test_revocation.py gains the status-message assertion.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

1 files changed, 11 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/hub.py b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
index 4aef93d..8692995 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/hub.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
@@ -1,22 +1,29 @@
 """Hub info endpoints — /v1/hub/*"""
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
 from meshbay_common import MNP_VERSION, MHP_VERSION
-from meshbay_hub import __version__
+from meshbay_hub import __version__, hub_settings
 from meshbay_hub.auth import hub_public_key_pem
-from meshbay_hub.db.engine import get_engine
+from meshbay_hub.db.engine import get_db, get_engine
 
 router = APIRouter(prefix="/v1/hub", tags=["hub"])
 
 
 @router.get("/info")
-async def hub_info():
+async def hub_info(db: AsyncSession = Depends(get_db)):
     engine = get_engine()
     return {
         "hub_version": __version__,
         "mnp_version": MNP_VERSION,
         "mhp_version": MHP_VERSION,
         "db_dialect":  engine.dialect.name,
+        # Instance policy the SPA needs before drawing the create-group form.
+        # Unauthenticated on purpose: it is not a secret, and the form is
+        # reachable before the group list loads. The hub enforces it regardless
+        # of what any client does with this flag.
+        "allow_public_groups": await hub_settings.public_groups_allowed(db),
     }