fix(hub): enforce registration captcha for every client

The server only checked the captcha when auth_key was absent — but
every real client (browser included, via the password split) sends
auth_key, so the check was off for everyone, and a bot skipped it by
including the field. The Register form still made humans solve a
widget whose token was never transmitted.

Gate is now unconditional on captcha.enabled. The web client
(registerUser in keyderive.js) forwards captcha.token; RegisterPage
resets the (single-use) token on a failed attempt. The desktop client
shares this UI source and is Chromium, so it renders the same widget
(see the paired meshbay-client commit for the CSP change that allows
it).

Tests: test_register_captcha.py.

Third security review, finding M1 (Option A).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 8 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js b/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js
index df08bc4..4c00137 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js
@@ -237,8 +237,11 @@ export function RegisterPage() {
         const rk = window.MeshBayKeys.generateRecoveryKey();
         // `name` (trimmed), not the raw field: the hub stores the trimmed
         // username and every key derivation must fold in the same string.
+        // `captcha.token` rides along — the submit button is already disabled
+        // until it is set when a captcha is configured (see the form below).
         await window.MeshBayKeys.registerUser(
-          name, email, password, emailRecovery ? rk.mnemonic : null);
+          name, email, password, emailRecovery ? rk.mnemonic : null,
+          captcha.token);
         setRecoveryMnemonic(rk.mnemonic);
         session.recoveryKey =
           await window.MeshBayKeys.deriveRecoveryKey(rk.mnemonic, name);
@@ -257,6 +260,10 @@ export function RegisterPage() {
       }
     } catch (err) {
       setError(err.message);
+      // A reCAPTCHA token is single-use: after a failed attempt (name taken,
+      // e-mail in use…) it is spent, so clear it and make the user solve a
+      // fresh one before the next try. No-op when no captcha is configured.
+      captcha.reset();
     } finally {
       setLoading(false);
     }