feat(chat): encrypt group chat under per-device epoch keys (MNP 2.0)

Chat messages are sealed with AES-256-GCM under a key derived per group, per
epoch, per *device*, and signed over the ciphertext with the device key the
node pinned. The node relays and archives; it cannot read a message.

There is no switch. MNP goes to 2.0 and MNP_MIN_SUPPORTED moves with it, so a
1.x peer is refused at the handshake with `version_too_old` rather than
admitted and then unable to speak. An opt-in flag was designed and rejected:
every node is a test node, so it would have bought nothing and left a plaintext
branch reachable — C6's lesson one feature later. A test reads the source and
refuses any code that consults a `chat_encrypted` setting.

Not Sender Keys, and `senderkeys.py` is now documented as unused. With
distribution under the group key and a node that serves history to devices
which were not present, the node must retain each chain's earliest key, and a
chain key at iteration i yields every message key from i on by pure HKDF —
forward secrecy is zero either way. What the ratchet was left buying was
stateful client code with silent failure modes, three of them reproduced: any
member could sign as any other, a second device dropped the first's chain, and
the skipped-key cache grew without bound. The reasoning is in
docs/chat-sender-keys.md, which is the specification and the decision record.

Epochs, not rotation: the epoch key is wrapped under the group key at delivery
and never stored under it, so `gek_rotate` is a re-wrap. A group-key-derived
archive key would have made every message ever sent unreadable on the first
`member unpin`, which is the documented step after removing a member. A new
epoch opens on member revoke/unpin, device revoke and `gek_rotate`; old epochs
are kept and still delivered, so history stays readable to everyone who could
already read it, and nothing anywhere deletes one.

Three prerequisites this needed, each a live defect on its own:

* The peer registry was keyed by user_id, so one account's second device
  evicted the first and the broadcast skipped recipients by account — a
  person's phone never saw what they typed on their laptop.
* The handshake authenticated an account, never a device. `device_hello`
  (additive, signed, refused unless the key is a live device of this account in
  the node's own roster) is what lets the node refuse a member claiming
  somebody else's key.
* `_admin_exec_file_delete` authorized against the exact uploading key, so
  device linking had already broken deleting your own file from your other
  device. It now authorizes against any non-revoked device of `uploader_id`.

Found by driving the real panel over the real transport, not by reading source:
`chat_keys_resp` was routed by arrival order and handed to an unanswered
`media_meta_req` — the original frozen-tab defect in a message type that did
not exist when that probe was written. And `_asText` had been deleted with an
unrelated helper beside it; its only caller sits inside a promise the panel
catches, so every conversation rendered empty with nothing in the console.

Existing node data is migrated by QE/migration/migrate_chat_encryption.py
(not versioned, per the QE rule), run with the node stopped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TZZxYjz8YeWRz13xDi8LJr

1 files changed, 12 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 044611e..cd0332c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -625,6 +625,15 @@ export default {
   'chat.unread': '新消息',
   'chat.jump_latest': '跳到最新',
   'chat.jump_new': '新消息',
+  'chat.unreadable': '无法读取此消息',
+  'chat.unreadable_signature': '未验证的消息 — 签名与发送者不符',
+  'chat.unreadable_epoch': '在此设备能够读取该对话之前写入',
+  'chat.unreadable_keys': '聊天密钥不可用 — 请重新连接以读取',
+  'chat.unreadable_decrypt': '无法解密此消息',
+  'chat.unreadable_envelope': '此消息传输不完整',
+  'chat.unreadable_format': '此消息需要更新版本的 MeshBay',
+  'chat.encrypted_needs_newer': '该对话已加密，此客户端无法读取 — 请更新 MeshBay',
+  'chat.encrypted_cannot_send': '该对话已加密，此设备尚无法在其中发言',
   'group.leave': '退出群组',
   'group.leave_confirm': '退出“{name}”？您将失去其文件和聊天的访问权。您上传的文件仍留在 node 上，node 也会保留它为您固定的身份，直到其运营者将其移除。',
   'group.mute': 'Mute notifications',
@@ -833,6 +842,9 @@ export default {
   'settings_app.chat_no_writable_root': '该群组没有可写目录，因此附件已停用。',
   'settings_app.chat_link_preview_label': '链接预览',
   'settings_app.chat_link_preview_hint': '当成员发布链接时，节点会抓取该页面的标题和图片。这是从你的机器发往他人所选站点的请求。',
+  'settings_app.chat_encrypted_always': '本群组的聊天始终加密，无法关闭。',
+  'settings_app.chat_rotate_epoch': '更换聊天密钥',
+  'settings_app.chat_rotate_epoch_hint': '成员仍可阅读全部历史记录。已被移出群组的人无法阅读此后写入的内容。移除成员或设备时已自动执行此操作。',
   'settings_app.tmdb_token_prompt': '在 TMDB 注册以生成你自己的 API 密钥。',
   'settings_app.tmdb_token_link': '获取密钥',
   'settings_node.roots_offline_hint': '未连接到节点 — 变更将通过本地节点进行，并在其下次重新加载时生效。',