feat(groups): editable description, and one source of operator authority

A description could only be set the moment a group was created, so every
group made before anyone thought of one stayed blank for good. The owner
can now edit it from the group's page, and PATCH /v1/groups/{id} takes it.

That endpoint takes the description and nothing else, deliberately. The
name, the visibility and the join policy are the terms members joined on;
a private group that can quietly become public is not the group they
agreed to be in. Changing those needs a decision about who gets told, not
a field on a form — there is a test saying so.

Separately, the legacy operator key is gone. `admin_pk_ed25519` in
node.toml named the operator before the roster existed and was kept so
that an existing deployment would keep working; nothing uses it, and a
second source of node authority is not something to carry around out of
politeness. Authority is the roster, read fresh on every check.

It is removed rather than ignored: a config that still names the key gets
a warning at startup pointing at the file. Dropping it in silence would
refuse invites and file deletion with a signature error that looks like a
bug somewhere else — which is exactly how finding M3 presented.

Two tests were verifying admin operations by naming a key in the context,
which was the legacy path. They now pair an operator into a roster, the
way an operator does. The authority test anchored on the deleted function
and passed vacuously once it disappeared; it states the invariant against
the verifier and the daemon instead.

Also defined .btn-secondary, used in four places and styled in none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
index cca595d..a6281e2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
@@ -278,6 +278,11 @@ const en = {
     + 'you normally talk. It works once, and it never passes through the hub.',
   'members.invite_code_hint': 'They enter it the first time they open this group. '
     + 'You do not need to be online then.',
+  'group.desc_edit': 'Edit description',
+  'group.desc_add': 'Add a description',
+  'group.desc_save': 'Save',
+  'group.desc_cancel': 'Cancel',
+  'group.desc_placeholder': 'What this group is for — members see it on their home page.',
   'group.join_code_title': 'This node needs to recognise you',
   'group.join_code_hint': 'Ask whoever invited you for the one-time code, and enter '
     + 'it here. After that this browser is recognised and you will not be asked again.',