feat(hub): reCAPTCHA v2 on Register and Password Reset pages

Server-side verification module, CaptchaConfig in hub.toml,
captcha_site_key exposed via /v1/hub/info, useCaptcha() hook
in the SPA with stable DOM rendering (strength bar always present
to avoid Preact re-ordering the captcha widget). Native clients
(auth_key path) skip captcha. All 10 locales updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/hub.py b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
index 8692995..8223400 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/hub.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
@@ -6,10 +6,18 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from meshbay_common import MNP_VERSION, MHP_VERSION
 from meshbay_hub import __version__, hub_settings
 from meshbay_hub.auth import hub_public_key_pem
+from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import get_db, get_engine
 
 router = APIRouter(prefix="/v1/hub", tags=["hub"])
 
+_cfg: HubConfig | None = None
+
+
+def set_config(cfg: HubConfig) -> None:
+    global _cfg
+    _cfg = cfg
+
 
 @router.get("/info")
 async def hub_info(db: AsyncSession = Depends(get_db)):
@@ -24,6 +32,7 @@ async def hub_info(db: AsyncSession = Depends(get_db)):
         # reachable before the group list loads. The hub enforces it regardless
         # of what any client does with this flag.
         "allow_public_groups": await hub_settings.public_groups_allowed(db),
+        "captcha_site_key": _cfg.captcha.site_key if _cfg and _cfg.captcha.enabled else "",
     }