feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth

Baseline commit capturing in-progress Phase 12 work that was already present
in the working tree (uncommitted) before the Phase 11.5 security remediation
begins. Committed as-is, without review or modification, so that remediation
changes arrive as a separable diff.

Contents: BundleStore (P2P GEK + keypair bundles), password split
(auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped
JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin
challenge-response, node local admin UI rewrite, browser key persistence.

Not authored in this session — captured to establish a baseline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2 files changed, 0 insertions, 14 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py
index 779efdc..a59a3d1 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py
@@ -63,14 +63,12 @@ def upgrade() -> None:
     )
     op.create_index('ix_content_reports_group', 'content_reports', ['group_id'], unique=False)
     op.create_index('ix_content_reports_hash', 'content_reports', ['content_hash'], unique=False)
-    op.add_column('users', sa.Column('keypair_bundle', sa.Text(), nullable=True))
     # ### end Alembic commands ###
 
 
 def downgrade() -> None:
     """Downgrade schema."""
     # ### commands auto generated by Alembic - please adjust! ###
-    op.drop_column('users', 'keypair_bundle')
     op.drop_index('ix_content_reports_hash', table_name='content_reports')
     op.drop_index('ix_content_reports_group', table_name='content_reports')
     op.drop_table('content_reports')
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py
index d4a9aa6..5192eb8 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py
@@ -84,17 +84,6 @@ def upgrade() -> None:
     sa.UniqueConstraint('token_hash')
     )
     op.create_index('ix_refresh_tokens_hash', 'refresh_tokens', ['token_hash'], unique=False)
-    op.create_table('gek_bundles',
-    sa.Column('group_id', sa.String(length=36), nullable=False),
-    sa.Column('user_id', sa.String(length=36), nullable=False),
-    sa.Column('pk_eph_b64', sa.String(length=64), nullable=False),
-    sa.Column('nonce_b64', sa.String(length=32), nullable=False),
-    sa.Column('wrapped_b64', sa.String(length=128), nullable=False),
-    sa.Column('stored_at', sa.DateTime(timezone=True), nullable=False),
-    sa.ForeignKeyConstraint(['group_id'], ['groups.id'], ),
-    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
-    sa.PrimaryKeyConstraint('group_id', 'user_id')
-    )
     op.create_table('group_members',
     sa.Column('group_id', sa.String(length=36), nullable=False),
     sa.Column('user_id', sa.String(length=36), nullable=False),
@@ -110,7 +99,6 @@ def downgrade() -> None:
     """Downgrade schema."""
     # ### commands auto generated by Alembic - please adjust! ###
     op.drop_table('group_members')
-    op.drop_table('gek_bundles')
     op.drop_index('ix_refresh_tokens_hash', table_name='refresh_tokens')
     op.drop_table('refresh_tokens')
     op.drop_index('ix_nodes_user_id', table_name='nodes')