feat(client): the platform seam, and an Electron shell that has never been run

Stage D, and the honest half of it.

D1 — the seam (done, and verified)
----------------------------------
`static/platform.js`. `HUB` becomes `platform.hubBase()` and the transport is
built with the same base, so one address has one source. In a browser it returns
'' and every path stays relative to the origin that served the page — the
acceptance criterion for this split was "the browser SPA behaves identically",
and it does. `platform.js` joins `_ASSETS`, or a change to it would not move the
content hash and a cached browser would never ask for it.

D2 — the shell (written, never launched)
-----------------------------------------
**There is no npm on this machine. Electron was never installed and
`packages/meshbay-client/` has not been run once.** That is stated here rather
than discovered later.

What is there: a main process serving the packaged interface over a privileged
`app://` scheme (`secure` and `standard` are not cosmetic — without them the
service worker refuses to register and streamed downloads break silently), a
preload exposing an enumerated bridge that never passes a filesystem path, a
window with `sandbox`, `contextIsolation` and no node integration, navigation
away from the package refused, and a CSP where the hub is reachable over
connect-src and is not a script source. The hub address arrives as a process
argument because `platform.hubBase()` runs before anything can await.

`test_desktop_shell.py` pins each of those by reading the source — the treatment
`test_downloads.py` already gives the three browser save paths. It catches a
property being removed and proves nothing about the application running. Two
were checked by breaking them.

The interface is *copied* into the package by `build/sync-ui.js` from the hub's
static directory, and `ui/` is gitignored: a silent fork is the only real way to
end up maintaining the interface twice.

D3 — partial
------------
The bridge, and the part worth having now: safeStorage's backend is reported
rather than assumed. On Linux it falls back to a fixed key when no keyring is
running, silently — someone who believes the OS is holding their keys is told
when it is not. The native key lifecycle belongs with D4 and needs a running
application to mean anything.

D8 — partial, and a real defect found
--------------------------------------
`meshbay-node.spec` installed the SYSTEM template — the one carrying `User=%i` —
into `%{_userunitdir}`. A user unit already runs as its owner and cannot carry
`User=`; systemd refuses the file, so the packaged unit could never have
started. Nothing noticed because nobody had built and installed the RPM.

Two units now: the template to `%{_unitdir}`, and a new `meshbay-node-user.service`
that a person enables themselves without a password — which is what lets the
desktop client install a node without asking for one. It carries ExecReload, so
`meshbay-node reload` does not have to stop a service somebody is streaming from,
and documents the drop-in for a drive outside the home, RequiresMountsFor
included.

798 tests pass; e2e.py still passes end to end. Nothing here was built or
launched: no npm, no rpmbuild.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 31 insertions, 2 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index a48535a..abb3374 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -6,10 +6,15 @@ import { t, getLocale, setLocale, initLocale, LOCALES } from './i18n.js';
 import { ZipStream, entriesUnder } from './zipstream.js';
 import { transfers, formatSpeed } from './transfers.js';
 import * as downloads from './downloads.js';
+import * as platform from './platform.js';
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
-const HUB = '';
+// Where the hub is. Empty in a browser — it served this page, so a relative
+// path cannot be pointed at the wrong place. In the installed app the page
+// comes from disk and has no origin of its own, so the base is configured.
+// See platform.js.
+const HUB = platform.hubBase();
 const AUTH_KEY = 'mb_auth';
 // Renew an access token with this much life left rather than waiting for it to
 // fail. Generous against a one-hour token: a film is watched without the hub
@@ -1323,7 +1328,9 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth,
         // connection at all. Renewals are shared, so if one is already in
         // flight this waits for it instead of starting a second.
         const live = (await ensureFreshToken()) || token;
-        const transport = new window.MeshBayTransport('', live);
+        // The same base the API calls use: signaling is a hub endpoint like
+        // any other, and two sources for one address is how they drift.
+        const transport = new window.MeshBayTransport(HUB, live);
         transportRef.current = transport;
 
         const ack = await transport.connect(
@@ -3941,6 +3948,15 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
   // Read from the hub rather than written here: the two constants that used to
   // sit in this markup said 0.1.0 and MNP 0.1 long after both had moved on.
   const [hubInfo, setHubInfo] = useState(null);
+  // On a desktop build, whether the OS is really holding the keys. Electron's
+  // safeStorage falls back to a fixed key when no keyring is running — a
+  // headless session, a minimal desktop — and does it silently. Somebody who
+  // believes the OS is protecting their keys deserves to be told when it is not.
+  const [keyBackend, setKeyBackend] = useState('');
+  useEffect(() => {
+    if (!platform.secrets.available) return;
+    platform.secrets.backend().then(setKeyBackend).catch(() => {});
+  }, []);
 
   useEffect(() => {
     hubFetch('/v1/hub/version').then(setHubInfo).catch(() => {});
@@ -4043,6 +4059,19 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
         </div>
       `}
 
+      ${keyBackend && html`
+        <div class="settings-section">
+          <h3 class="settings-heading">${t('settings.keys_heading')}</h3>
+          <div class="settings-row">
+            <span class="settings-label">${t('settings.keys_where')}</span>
+            <span class="settings-value">${keyBackend}</span>
+          </div>
+          ${keyBackend === 'unprotected_fallback' && html`
+            <p class="error-msg">${t('settings.keys_unprotected')}</p>
+          `}
+        </div>
+      `}
+
       <div class="settings-section">
         <h3 class="settings-heading">${t('settings.about')}</h3>
         <div class="settings-row">