feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 45 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index c1697a7..bb88283 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -25,6 +25,7 @@ On receipt: immediately refuse JWT tokens matching the revoked user_id,
 and close active connections for that user.
 """
 
+import asyncio
 import base64
 import json
 import logging
@@ -50,6 +51,7 @@ router = APIRouter(tags=["revocation"])
 # ── Connected node registry ───────────────────────────────────────────────────
 
 _connected_nodes: dict[str, WebSocket] = {}   # node_id → websocket
+_punch_events: dict[str, asyncio.Event] = {}  # node_id → signaling event
 
 
 def get_connected_node_count() -> int:
@@ -122,12 +124,16 @@ async def node_websocket(ws: WebSocket):
         log.info("Node WS connected: %s", node_id[:8])
         await ws.send_text(json.dumps({"type": "auth_ok", "node_id": node_id}))
 
-        # Keep-alive loop — wait for ping or disconnect
+        # Message loop — handle ping, punch_ready, etc.
         while True:
             raw = await ws.receive_text()
             msg = json.loads(raw)
             if msg.get("type") == "ping":
                 await ws.send_text(json.dumps({"type": "pong"}))
+            elif msg.get("type") == "punch_ready":
+                event = _punch_events.get(node_id)
+                if event:
+                    event.set()
 
     except WebSocketDisconnect:
         log.info("Node WS disconnected: %s", (node_id or "unknown")[:8])
@@ -140,6 +146,44 @@ async def node_websocket(ws: WebSocket):
 
 # ── Admin revocation endpoint ─────────────────────────────────────────────────
 
+class IncomingRequest(BaseModel):
+    peer_ip:   str
+    peer_port: int
+
+
+@router.post("/v1/nodes/{node_id}/incoming", status_code=200)
+async def notify_incoming(
+    node_id: str,
+    body: IncomingRequest,
+    current_user: User = Depends(get_current_user),
+):
+    """
+    Signal a node that a client wants to connect (NAT punch coordination).
+    Hub forwards the request via WebSocket; node punches NAT and replies punch_ready.
+    """
+    ws = _connected_nodes.get(node_id)
+    if not ws:
+        raise HTTPException(status_code=404, detail="Node not connected")
+
+    event = asyncio.Event()
+    _punch_events[node_id] = event
+
+    await ws.send_text(json.dumps({
+        "type": "client_incoming",
+        "peer_ip": body.peer_ip,
+        "peer_port": body.peer_port,
+    }))
+
+    try:
+        await asyncio.wait_for(event.wait(), timeout=5.0)
+    except asyncio.TimeoutError:
+        raise HTTPException(status_code=504, detail="Node did not respond in time")
+    finally:
+        _punch_events.pop(node_id, None)
+
+    return {"status": "ready", "node_id": node_id}
+
+
 class RevokeRequest(BaseModel):
     target:    str   # "user" or "group"
     target_id: str