feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth

Baseline commit capturing in-progress Phase 12 work that was already present
in the working tree (uncommitted) before the Phase 11.5 security remediation
begins. Committed as-is, without review or modification, so that remediation
changes arrive as a separable diff.

Contents: BundleStore (P2P GEK + keypair bundles), password split
(auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped
JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin
challenge-response, node local admin UI rewrite, browser key persistence.

Not authored in this session — captured to establish a baseline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 5 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index 11ad112..563a1eb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -30,8 +30,9 @@ _ARGON2_KEY_LEN = 32
 _ARGON2_VERSIONS = {
     1: {"iterations": 3, "memory_cost": 65536},     # 64 MB  — initial
     2: {"iterations": 3, "memory_cost": 262144},    # 256 MB — production target
+    3: {"iterations": 3, "memory_cost": 262144},    # 256 MB — auth_key input (password split)
 }
-_ARGON2_CURRENT_VERSION = 2
+_ARGON2_CURRENT_VERSION = 3
 
 # Module-level hub keypair (loaded once at startup)
 _hub_sk_pem: bytes | None = None
@@ -133,11 +134,13 @@ def issue_access_token(
     pk_user: str,
     ttl: int = 3600,
     groups: list[str] | None = None,
+    scope: str = "user",
 ) -> str:
     """
     Issue a signed JWT access token.
     Includes jti (UUID4) — required to prevent replay and enable revocation.
     Includes groups — list of group_ids the user is a member of (node-side authz).
+    scope: "user" (browser, full access) or "node" (daemon, restricted).
     """
     if _hub_sk_pem is None:
         raise RuntimeError("Hub keypair not loaded")
@@ -151,6 +154,7 @@ def issue_access_token(
         "iat":     now,
         "exp":     now + ttl,
         "groups":  groups or [],
+        "scope":   scope,
     }
     return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA")