feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 15 insertions, 9 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 130240e..fbba6d7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -100,18 +100,24 @@ def _generate_code() -> str:
 async def _verify_captcha_or_raise(token: str | None, request: Request) -> None:
     if not token:
         raise HTTPException(status_code=400, detail="captcha_required")
-    from meshbay_hub.captcha import verify_captcha
-    ok = await verify_captcha(
-        _cfg.captcha.secret_key,  # type: ignore[union-attr]
-        token,
-        request.client.host if request.client else None,
-        _cfg.captcha.host_check,  # type: ignore[union-attr]
-        _cfg.captcha.allow_unattributed_host,  # type: ignore[union-attr]
-    )
-    if not ok:
+    from meshbay_hub.captcha import verify
+    if not verify(token):
         raise HTTPException(status_code=400, detail="captcha_failed")
 
 
+@router.get("/captcha")
+@limiter.limit("30/minute")
+async def captcha_challenge(request: Request):
+    """A proof-of-work challenge for the register and reset-request forms.
+
+    404 when this hub has the check turned off, so the page sends no answer.
+    """
+    if not (_cfg and _cfg.captcha.enabled):
+        raise HTTPException(status_code=404, detail="captcha_disabled")
+    from meshbay_hub.captcha import issue
+    return issue(_cfg.captcha.max_number)
+
+
 # ── Models ────────────────────────────────────────────────────────────────────
 
 # Mirrored by USERNAME_MIN_LEN in static/auth-page.js; test_username_floor.py