feat(client): the platform seam, and an Electron shell that has never been run

Stage D, and the honest half of it.

D1 — the seam (done, and verified)
----------------------------------
`static/platform.js`. `HUB` becomes `platform.hubBase()` and the transport is
built with the same base, so one address has one source. In a browser it returns
'' and every path stays relative to the origin that served the page — the
acceptance criterion for this split was "the browser SPA behaves identically",
and it does. `platform.js` joins `_ASSETS`, or a change to it would not move the
content hash and a cached browser would never ask for it.

D2 — the shell (written, never launched)
-----------------------------------------
**There is no npm on this machine. Electron was never installed and
`packages/meshbay-client/` has not been run once.** That is stated here rather
than discovered later.

What is there: a main process serving the packaged interface over a privileged
`app://` scheme (`secure` and `standard` are not cosmetic — without them the
service worker refuses to register and streamed downloads break silently), a
preload exposing an enumerated bridge that never passes a filesystem path, a
window with `sandbox`, `contextIsolation` and no node integration, navigation
away from the package refused, and a CSP where the hub is reachable over
connect-src and is not a script source. The hub address arrives as a process
argument because `platform.hubBase()` runs before anything can await.

`test_desktop_shell.py` pins each of those by reading the source — the treatment
`test_downloads.py` already gives the three browser save paths. It catches a
property being removed and proves nothing about the application running. Two
were checked by breaking them.

The interface is *copied* into the package by `build/sync-ui.js` from the hub's
static directory, and `ui/` is gitignored: a silent fork is the only real way to
end up maintaining the interface twice.

D3 — partial
------------
The bridge, and the part worth having now: safeStorage's backend is reported
rather than assumed. On Linux it falls back to a fixed key when no keyring is
running, silently — someone who believes the OS is holding their keys is told
when it is not. The native key lifecycle belongs with D4 and needs a running
application to mean anything.

D8 — partial, and a real defect found
--------------------------------------
`meshbay-node.spec` installed the SYSTEM template — the one carrying `User=%i` —
into `%{_userunitdir}`. A user unit already runs as its owner and cannot carry
`User=`; systemd refuses the file, so the packaged unit could never have
started. Nothing noticed because nobody had built and installed the RPM.

Two units now: the template to `%{_unitdir}`, and a new `meshbay-node-user.service`
that a person enables themselves without a password — which is what lets the
desktop client install a node without asking for one. It carries ExecReload, so
`meshbay-node reload` does not have to stop a service somebody is streaming from,
and documents the drop-in for a drive outside the home, RequiresMountsFor
included.

798 tests pass; e2e.py still passes end to end. Nothing here was built or
launched: no npm, no rpmbuild.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

10 files changed, 30 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 5a946f7..ae356ba 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -198,6 +198,9 @@ export default {
   'settings.theme_system': 'System',
   'settings.language': 'Sprache',
   'settings.about': 'Über',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Version',
   'settings.protocol': 'Protokoll',
   'settings.role': 'Rolle',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index fd2d6ec..fe6bd0f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -190,6 +190,9 @@ export default {
   'settings.theme_system': 'System',
   'settings.language': 'Language',
   'settings.about': 'About',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Version',
   'settings.protocol': 'Protocol',
   'settings.role': 'Role',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index e564164..3066963 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -194,6 +194,9 @@ export default {
   'settings.theme_system': 'Sistema',
   'settings.language': 'Idioma',
   'settings.about': 'Acerca de',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Versión',
   'settings.protocol': 'Protocolo',
   'settings.role': 'Rol',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 5848f9d..c94089d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -198,6 +198,9 @@ export default {
   'settings.theme_system': 'Système',
   'settings.language': 'Langue',
   'settings.about': 'À propos',
+  'settings.keys_heading': 'Clés sur cet appareil',
+  'settings.keys_where': 'Protégées par',
+  'settings.keys_unprotected': 'Aucun trousseau système ne fonctionne : vos clés sont chiffrées avec une clé qui n’est pas secrète. Quiconque peut lire les fichiers de cette machine peut les lire. Démarrez un trousseau, ou considérez cet appareil comme non fiable.',
   'settings.version': 'Version',
   'settings.protocol': 'Protocole',
   'settings.role': 'Rôle',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 61913e3..56beb8d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -197,6 +197,9 @@ export default {
   'settings.theme_system': 'Sistema',
   'settings.language': 'Lingua',
   'settings.about': 'Informazioni',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Versione',
   'settings.protocol': 'Protocollo',
   'settings.role': 'Ruolo',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index aa656ee..5d83bb9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -192,6 +192,9 @@ export default {
   'settings.theme_system': 'システムに合わせる',
   'settings.language': '言語',
   'settings.about': 'このアプリについて',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'バージョン',
   'settings.protocol': 'プロトコル',
   'settings.role': '権限',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index dae903f..55c7d81 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -198,6 +198,9 @@ export default {
   'settings.theme_system': 'Systeem',
   'settings.language': 'Taal',
   'settings.about': 'Over',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Versie',
   'settings.protocol': 'Protocol',
   'settings.role': 'Rol',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 65c81ca..3cf909f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -204,6 +204,9 @@ export default {
   'settings.theme_system': 'Systemowy',
   'settings.language': 'Język',
   'settings.about': 'O programie',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Wersja',
   'settings.protocol': 'Protokół',
   'settings.role': 'Rola',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 729a7fc..714dff6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -196,6 +196,9 @@ export default {
   'settings.theme_system': 'Sistema',
   'settings.language': 'Idioma',
   'settings.about': 'Sobre',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': 'Versão',
   'settings.protocol': 'Protocolo',
   'settings.role': 'Função',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 0ff5a49..c3d9494 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -183,6 +183,9 @@ export default {
   'settings.theme_system': '跟随系统',
   'settings.language': '语言',
   'settings.about': '关于',
+  'settings.keys_heading': 'Keys on this device',
+  'settings.keys_where': 'Protected by',
+  'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
   'settings.version': '版本',
   'settings.protocol': '协议',
   'settings.role': '角色',