feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 0 insertions, 2 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py
index 2ad71bd..6155470 100644
--- a/packages/meshbay-hub/src/meshbay_hub/app.py
+++ b/packages/meshbay-hub/src/meshbay_hub/app.py
@@ -23,7 +23,6 @@ from meshbay_hub.api.federation import router as federation_router
 from meshbay_hub.api.groups import router as groups_router
 from meshbay_hub.api.health import router as health_router
 from meshbay_hub.api.hub import router as hub_router
-from meshbay_hub.api.hub import set_config as hub_set_config
 from meshbay_hub.api.invite_links import redeem_router as invite_links_redeem_router
 from meshbay_hub.api.invite_links import router as invite_links_router
 from meshbay_hub.api.middleware import limiter
@@ -140,7 +139,6 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
             generate_hub_keypair(kp)
         load_hub_keypair(kp, cfg.identity.id)
         users_set_config(cfg)
-        hub_set_config(cfg)
         set_admin_usernames(cfg.identity.admin_usernames)
 
         await _backfill_email_hashes()