feat(hub): Phase 10.5–10.8, 10.10 — notifications, settings, search, version

- 10.5: Notification model + CRUD API (list, mark read, mark all read)
  Triggered on: group invite, role change, suspend/unsuspend
- 10.6: SettingsPage shows role, per-group notification mute (localStorage)
- 10.7: GET /v1/groups?q= search filter (ilike on name)
- 10.8: NotificationFeed on home page + bell with unread badge in navbar
- 10.10: GET /v1/hub/version endpoint for client update checks
- 8 new tests (test_notifications.py), 155 total

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

4 files changed, 139 insertions, 8 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
index c3fa8c2..88e231a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
@@ -134,11 +134,17 @@ async def admin_patch_user(
     if user.id == current_user.id:
         raise HTTPException(status_code=400, detail="Cannot modify your own account")
 
+    from meshbay_hub.api.notifications import create_notification
+
     if body.role is not None:
         if body.role not in ("user", "moderator", "admin"):
             raise HTTPException(status_code=422, detail="role must be user, moderator, or admin")
         user.role = body.role
         log.info("User %s role changed to %s by %s", user.username, body.role, current_user.username)
+        await create_notification(
+            db, user.id, "role_change",
+            f"Your role has been changed to {body.role}",
+        )
 
     if body.status is not None:
         if body.status not in ("active", "suspended", "revoked"):
@@ -146,6 +152,16 @@ async def admin_patch_user(
         user.status = body.status
         log.info("User %s status changed to %s by %s",
                  user.username, body.status, current_user.username)
+        if body.status == "suspended":
+            await create_notification(
+                db, user.id, "account_suspended",
+                "Your account has been suspended",
+            )
+        elif body.status == "active":
+            await create_notification(
+                db, user.id, "account_restored",
+                "Your account has been restored",
+            )
 
     db.add(IPLog(
         user_id=current_user.id,
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 6dd4275..a8a45c9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -69,16 +69,17 @@ async def group_online_nodes(
 @router.get("")
 async def list_public_groups(
     db: AsyncSession = Depends(get_db),
+    q: str = "",
     limit: int = 50,
     offset: int = 0,
     include_federated: bool = True,
 ):
-    """List public groups — local and optionally federated. No auth required."""
+    """List/search public groups — local and optionally federated. No auth required."""
+    query = select(Group).where(Group.visibility == "public", Group.status == "active")
+    if q:
+        query = query.where(Group.name.ilike(f"%{q}%"))
     result = await db.execute(
-        select(Group)
-        .where(Group.visibility == "public", Group.status == "active")
-        .order_by(Group.created_at.desc())
-        .limit(limit).offset(offset)
+        query.order_by(Group.created_at.desc()).limit(limit).offset(offset)
     )
     local = result.scalars().all()
     groups = [
@@ -90,10 +91,11 @@ async def list_public_groups(
     ]
 
     if include_federated:
+        fed_query = select(FederatedGroup)
+        if q:
+            fed_query = fed_query.where(FederatedGroup.name.ilike(f"%{q}%"))
         fed_result = await db.execute(
-            select(FederatedGroup)
-            .order_by(FederatedGroup.updated_at.desc())
-            .limit(limit)
+            fed_query.order_by(FederatedGroup.updated_at.desc()).limit(limit)
         )
         for fg in fed_result.scalars().all():
             groups.append({
@@ -217,6 +219,7 @@ async def store_gek_bundle(
 
     # Upsert GEK bundle
     existing = await db.get(GEKBundle, (group_id, target.id))
+    new_member = False
     if existing:
         existing.pk_eph_b64  = body.pk_eph_b64
         existing.nonce_b64   = body.nonce_b64
@@ -233,6 +236,15 @@ async def store_gek_bundle(
         mem = await db.get(GroupMember, (group_id, target.id))
         if not mem:
             db.add(GroupMember(group_id=group_id, user_id=target.id))
+            new_member = True
+
+    if new_member:
+        from meshbay_hub.api.notifications import create_notification
+        await create_notification(
+            db, target.id, "group_invite",
+            f"You were added to {group.name}",
+            link=f"#/group/{group_id}",
+        )
 
     await db.commit()
     return {"status": "stored", "group_id": group_id, "username": username}
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/hub.py b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
index 00aba28..6e2db9e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/hub.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/hub.py
@@ -24,3 +24,13 @@ async def hub_info():
 async def hub_pubkey():
     """Hub Ed25519 public key PEM — cached by nodes on first contact."""
     return {"pk_hub_pem": hub_public_key_pem().decode()}
+
+
+@router.get("/version")
+async def hub_version():
+    """Version check endpoint for clients to detect updates."""
+    return {
+        "hub": __version__,
+        "mnp": MNP_VERSION,
+        "mhp": MHP_VERSION,
+    }
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
new file mode 100644
index 0000000..e7d36d2
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
@@ -0,0 +1,93 @@
+"""Notification endpoints — /v1/notifications/*"""
+
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy import select, func, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from meshbay_hub.api.deps import get_current_user
+from meshbay_hub.db.engine import get_db
+from meshbay_hub.db.models import Notification, User
+
+router = APIRouter(prefix="/v1/notifications", tags=["notifications"])
+
+
+@router.get("")
+async def list_notifications(
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+    limit: int = 50,
+    offset: int = 0,
+    unread_only: bool = False,
+):
+    query = select(Notification).where(Notification.user_id == current_user.id)
+    if unread_only:
+        query = query.where(Notification.read == False)  # noqa: E712
+    result = await db.execute(
+        query.order_by(Notification.created_at.desc()).limit(limit).offset(offset)
+    )
+    notifs = result.scalars().all()
+
+    count_q = select(func.count()).select_from(Notification).where(
+        Notification.user_id == current_user.id, Notification.read == False  # noqa: E712
+    )
+    unread = (await db.execute(count_q)).scalar() or 0
+
+    return {
+        "notifications": [
+            {
+                "id": n.id,
+                "kind": n.kind,
+                "title": n.title,
+                "detail": n.detail,
+                "link": n.link,
+                "read": n.read,
+                "created_at": n.created_at.isoformat(),
+            }
+            for n in notifs
+        ],
+        "unread_count": unread,
+    }
+
+
+@router.post("/{notification_id}/read")
+async def mark_read(
+    notification_id: int,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    notif = await db.get(Notification, notification_id)
+    if not notif or notif.user_id != current_user.id:
+        raise HTTPException(status_code=404, detail="Notification not found")
+    notif.read = True
+    await db.commit()
+    return {"status": "ok"}
+
+
+@router.post("/read-all")
+async def mark_all_read(
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    await db.execute(
+        update(Notification)
+        .where(Notification.user_id == current_user.id, Notification.read == False)  # noqa: E712
+        .values(read=True)
+    )
+    await db.commit()
+    return {"status": "ok"}
+
+
+async def create_notification(
+    db: AsyncSession,
+    user_id: str,
+    kind: str,
+    title: str,
+    detail: str | None = None,
+    link: str | None = None,
+) -> Notification:
+    notif = Notification(
+        user_id=user_id, kind=kind, title=title, detail=detail, link=link,
+    )
+    db.add(notif)
+    await db.flush()
+    return notif