feat: unified group management, public groups, and activity-based sidebar

Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces
into a single multi-step page: group creation on hub, node attachment, root
selection via folder picker, GEK initialization, and auto-pairing — all in one
flow. Browser SPA keeps its current behavior unchanged.

Public group support (Option A — GEK for all groups):
- All groups have GEK regardless of visibility; open-join groups auto-admit
  via TOFU when join_policy is "open"
- Key rotation blocked for public groups (API guard + UI hidden)
- Hub signaling allows WebRTC offers for nodes hosting open-join groups even
  when the caller isn't a member yet
- attach_group writes join_policy to node.toml
- Daemon loads GEK for all groups, not just private ones
- Known-device path in join_request now auto-admits to open-join groups

Node loopback API bridge (Electron IPC):
- node:detect, node:call, node:pairing-code IPC handlers in main process
- Renderer never sees tokens, paths, or keys (session token = physical access)
- platform.js node namespace for UI consumption
- Loopback endpoints: roots CRUD, member-upload toggle, reload

Bug fixes:
- Root change detection: removed premature ctx["roots"] updates from add_root
  and remove_root that prevented indexer retarget on reload
- Duplicate offline message: global fallback now gated on !group
- Signaling membership check: fallback to open-join groups for non-members

Sidebar groups sorted by last_activity_at (most recent first):
- New Group.last_activity_at column with Alembic migration
- POST /v1/groups/{id}/activity endpoint, called on connect and chat send
- Client-side sort + throttled hub updates (1/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

3 files changed, 47 insertions, 9 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 6819ff6..65307f1 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -2,7 +2,8 @@
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
-from sqlalchemy import func, or_, select
+from datetime import datetime, timezone
+from sqlalchemy import func, or_, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.api.deps import get_current_user, require_user_scope
@@ -36,7 +37,7 @@ async def my_groups(
                # added to it before a node exists would see a name they cannot
                # open and cannot be told why.
                or_(Group.hosted_at.is_not(None), Group.admin_id == current_user.id))
-        .order_by(Group.name)
+        .order_by(Group.last_activity_at.desc())
     )
     groups = result.scalars().all()
     muted_rows = await db.execute(
@@ -63,12 +64,35 @@ async def my_groups(
                 # which is the evidence that actually concerns the user.
                 "node_online": bool(get_online_nodes_for_group(g.id)),
                 "hosted": g.hosted_at is not None,
+                "last_activity_at": g.last_activity_at.isoformat(),
             }
             for g in groups
         ]
     }
 
 
+@router.post("/{group_id}/activity")
+async def touch_group_activity(
+    group_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Bump a group's last_activity_at. Called by the client on chat/file events."""
+    result = await db.execute(
+        select(GroupMember.group_id).where(
+            GroupMember.group_id == group_id,
+            GroupMember.user_id == current_user.id,
+        ))
+    if not result.first():
+        raise HTTPException(status_code=403, detail="Not a member")
+    await db.execute(
+        update(Group)
+        .where(Group.id == group_id)
+        .values(last_activity_at=datetime.now(timezone.utc)))
+    await db.commit()
+    return {"ok": True}
+
+
 @router.get("/{group_id}/nodes")
 async def group_online_nodes(
     group_id: str,
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index d555f9f..003e396 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -285,6 +285,11 @@ async def node_websocket(ws: WebSocket):
             elif msg.get("type") == "webrtc_answer":
                 from meshbay_hub.api.signaling import handle_webrtc_answer
                 handle_webrtc_answer(msg)
+            elif msg.get("type") == "update_groups":
+                new_gids = msg.get("group_ids", [])
+                _node_groups[node_id] = new_gids
+                await _mark_hosted(new_gids)
+                log.info("Node %s updated groups: %d", node_id[:8], len(new_gids))
             elif msg.get("type") == "chat_notify":
                 asyncio.ensure_future(_handle_chat_notify(
                     msg.get("group_id", ""),
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
index cb00a67..84c1167 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
@@ -90,7 +90,9 @@ async def webrtc_offer(
     if not ws:
         raise HTTPException(status_code=404, detail="Node not connected")
 
-    # The caller must share at least one active group with the target node.
+    # The caller must share at least one active group with the target node,
+    # OR the node must host at least one open-join group (public groups admit
+    # anyone — the node's MNP handshake handles authorization).
     node_group_ids = set(_node_groups.get(node_id, []))
     if node_group_ids:
         result = await db.execute(
@@ -100,12 +102,19 @@ async def webrtc_offer(
             ))
         shared = [gid for (gid,) in result.all()]
         if not shared:
-            raise HTTPException(status_code=403, detail="Not a member of any group on this node")
-
-        active = await db.execute(
-            select(Group.id).where(Group.id.in_(shared), Group.status == "active"))
-        if not active.first():
-            raise HTTPException(status_code=403, detail="Group is not active")
+            has_open = await db.execute(
+                select(Group.id).where(
+                    Group.id.in_(node_group_ids),
+                    Group.join_policy == "open",
+                    Group.status == "active",
+                ))
+            if not has_open.first():
+                raise HTTPException(status_code=403, detail="Not a member of any group on this node")
+        else:
+            active = await db.execute(
+                select(Group.id).where(Group.id.in_(shared), Group.status == "active"))
+            if not active.first():
+                raise HTTPException(status_code=403, detail="Group is not active")
 
     if _pending_per_user.get(current_user.id, 0) >= MAX_PENDING_PER_USER:
         raise HTTPException(status_code=429, detail="Too many pending connections")