docs: generate an HTTP API listing for the hub and the node control API

docs/MESHBAY_HTTP_API.md lists every route of the hub (by domain, with the
authentication each requires) and of the node's loopback control API. It is
written by docs/generate_http_api.py from the routes and their docstrings;
test_http_api_doc.py fails when the file drifts from the code or when a
route has no docstring, so a new route must say what it does.

79 routes had no docstring and get a one-line description; a few whose first
line did not describe the route get a summary line.

The login page's developer docs gain an API link next to Design and
Protocol, in every language. README, MESHBAY_DESIGN.md (§0.1, §6.7, §7) and
CLAUDE.md point to the listing; README also points to examples/.

The examples scripts with a shebang become executable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index 5a33d77..2499374 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -438,7 +438,8 @@ async def _authorize_node_ws(token: str, claimed_id: str, claimed_groups) -> tup
 @router.websocket("/v1/nodes/ws")
 async def node_websocket(ws: WebSocket):
     """
-    Persistent WebSocket connection for nodes.
+    Persistent WebSocket connection for nodes, authenticated by the node's token in the
+    first message.
 
     Finding C2: this used to take `node_id` and `group_ids` straight from the
     client's first message, with no check that the authenticated user owned that