feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 3 insertions, 3 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index edf4df9..bd5282c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -401,9 +401,9 @@ async function registerUser(username, email, password, recoveryMnemonic, captcha
   // appends it to the verification e-mail and stores it nowhere
   // (docs/MESHBAY_DESIGN.md §3.6). Omitted when they chose to save it themselves.
   if (recoveryMnemonic) payload.recovery_key = recoveryMnemonic;
-  // reCAPTCHA response, when the hub has a captcha configured. The widget lives
-  // in RegisterPage (auth-page.js); this function just forwards its token. A
-  // hub with no captcha configured sends nothing and the server does not check.
+  // The proof-of-work answer, when the hub asks for one. RegisterPage
+  // (auth-page.js) works it out; this function just forwards it. A hub with
+  // the check turned off gets nothing and does not look.
   if (captchaToken) payload.captcha_token = captchaToken;
 
   const resp = await hubCall('/v1/users/register', {