feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 11 insertions, 3 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 5a7a3b4..5a2c7be 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -18,7 +18,7 @@ from meshbay_hub.auth import (
 )
 from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import IPLog, RefreshToken, User
+from meshbay_hub.db.models import GroupMember, IPLog, RefreshToken, User
 from meshbay_hub.api.deps import get_current_user
 
 router = APIRouter(prefix="/v1/users", tags=["users"])
@@ -136,7 +136,11 @@ async def login(
     if user.status != "active":
         raise HTTPException(status_code=403, detail=f"Account {user.status}")
 
-    access_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl())
+    memberships = await db.execute(
+        select(GroupMember.group_id).where(GroupMember.user_id == user.id))
+    group_ids = [gid for (gid,) in memberships.all()]
+    access_token = issue_access_token(
+        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
     raw_rt, rt_hash = generate_refresh_token()
 
     expires_at = datetime.now(timezone.utc) + timedelta(seconds=_refresh_ttl())
@@ -175,7 +179,11 @@ async def token_refresh(
     if not user or user.status != "active":
         raise HTTPException(status_code=401, detail="User not found or suspended")
 
-    new_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl())
+    memberships = await db.execute(
+        select(GroupMember.group_id).where(GroupMember.user_id == user.id))
+    group_ids = [gid for (gid,) in memberships.all()]
+    new_token = issue_access_token(
+        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
     return {"access_token": new_token, "token_type": "bearer", "expires_in": _ttl()}