feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

10 files changed, 10 insertions, 20 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 1fe2b36..bf16bca 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -139,8 +139,7 @@ export default {
   'register.strength': 'Stärke: etwa {bits} Bit. Sie schützt die Kopie Ihrer '
     + 'Schlüssel, die auf den Nodes liegt, denen Sie beitreten — es lohnt sich also, '
     + 'sie gut zu wählen.',
-  'captcha.required': 'Bitte das Captcha ausfüllen.',
-  'captcha.failed': 'Captcha-Überprüfung fehlgeschlagen — bitte erneut versuchen.',
+  'captcha.failed': "Die Prüfung gegen Roboter ist fehlgeschlagen. Bitte versuchen Sie es erneut.",
 
   // Home
   'home.welcome': 'Willkommen bei MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 642d3e2..c7dc47e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -140,8 +140,7 @@ export default {
     + 'your keys where they are stored — a few unrelated words work well.',
   'register.strength': 'Strength: about {bits} bits. This protects the copy of '
     + 'your keys kept on the nodes you join, so it is worth getting right.',
-  'captcha.required': 'Please complete the captcha.',
-  'captcha.failed': 'Captcha verification failed — please try again.',
+  'captcha.failed': "The anti-robot check failed. Please try again.",
 
   // Home
   'home.welcome': 'Welcome to MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index fe66af4..0831bac 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -137,8 +137,7 @@ export default {
     + 'relación entre sí funcionan muy bien.',
   'register.strength': 'Solidez: unos {bits} bits. Protege la copia de sus claves que '
     + 'se guarda en los nodes a los que se une, así que conviene acertar.',
-  'captcha.required': 'Por favor, complete el captcha.',
-  'captcha.failed': 'Verificación del captcha fallida — inténtelo de nuevo.',
+  'captcha.failed': "La verificación anti-robots ha fallado. Inténtelo de nuevo.",
 
   // Home
   'home.welcome': 'Bienvenido a MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 6296a8b..2a52848 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -138,8 +138,7 @@ export default {
   'register.strength': 'Robustesse : environ {bits} bits. Elle protège la copie de '
     + 'vos clés conservée sur les nodes que vous rejoignez, cela vaut donc la peine '
     + 'de la soigner.',
-  'captcha.required': 'Veuillez compléter le captcha.',
-  'captcha.failed': 'Vérification du captcha échouée — veuillez réessayer.',
+  'captcha.failed': "La vérification anti-robot a échoué. Veuillez réessayer.",
 
   // Home
   'home.welcome': 'Bienvenue sur MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 0751692..1dd3f52 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -138,8 +138,7 @@ export default {
     + 'legame tra loro funziona bene.',
   'register.strength': 'Robustezza: circa {bits} bit. Protegge la copia delle sue '
     + 'chiavi conservata sui node a cui aderisce, quindi vale la pena sceglierla con cura.',
-  'captcha.required': 'Completa il captcha.',
-  'captcha.failed': 'Verifica captcha fallita — riprova.',
+  'captcha.failed': "La verifica anti-robot non è riuscita. Riprovi.",
 
   // Home
   'home.welcome': 'Benvenuto in MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index c3d4fa8..0d4aadf 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -136,8 +136,7 @@ export default {
     + 'その鍵を守るものです。互いに関係のない単語をいくつか並べると効果的です。',
   'register.strength': '強度：約 {bits} ビット。参加している各 node に保管される鍵の'
     + 'コピーを守るものですので、しっかり決めておく価値があります。',
-  'captcha.required': 'キャプチャを完了してください。',
-  'captcha.failed': 'キャプチャの検証に失敗しました — もう一度お試しください。',
+  'captcha.failed': "ロボット対策の確認に失敗しました。もう一度お試しください。",
 
   // Home
   'home.welcome': 'MeshBay へようこそ',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index c02be99..31fc7b3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -139,8 +139,7 @@ export default {
   'register.strength': 'Sterkte: ongeveer {bits} bits. Ze beschermt de kopie van uw '
     + 'sleutels die op de nodes staat waar u zich bij aansluit, dus het loont om er '
     + 'even bij stil te staan.',
-  'captcha.required': 'Vul de captcha in.',
-  'captcha.failed': 'Captchaverificatie mislukt — probeer het opnieuw.',
+  'captcha.failed': "De controle tegen robots is mislukt. Probeer het opnieuw.",
 
   // Home
   'home.welcome': 'Welkom bij MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 97e8b53..e88272d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -143,8 +143,7 @@ export default {
     + 'bardzo dobrze.',
   'register.strength': 'Siła: około {bits} bitów. Chroni kopię kluczy przechowywaną na '
     + 'nodes, do których się dołącza, więc warto ją dobrać starannie.',
-  'captcha.required': 'Proszę wypełnić captcha.',
-  'captcha.failed': 'Weryfikacja captcha nie powiodła się — spróbuj ponownie.',
+  'captcha.failed': "Weryfikacja antyrobotowa nie powiodła się. Spróbuj ponownie.",
 
   // Home
   'home.welcome': 'Witamy w MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 8ff36a5..5b2d80f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -139,8 +139,7 @@ export default {
     + 'entre si funcionam muito bem.',
   'register.strength': 'Robustez: cerca de {bits} bits. Ela protege a cópia das suas '
     + 'chaves mantida nos nodes dos quais você participa, então vale a pena caprichar.',
-  'captcha.required': 'Por favor, complete o captcha.',
-  'captcha.failed': 'Verificação do captcha falhou — tente novamente.',
+  'captcha.failed': "A verificação anti-robô falhou. Tente novamente.",
 
   // Home
   'home.welcome': 'Bem-vindo ao MeshBay',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index d4ad64f..a6ea535 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -136,8 +136,7 @@ export default {
     + '几个互不相关的词就很好用。',
   'register.strength': '强度：约 {bits} 位。它保护的是您所加入的各个 node 上保存的密钥副本，'
     + '因此值得认真设置。',
-  'captcha.required': '请完成验证码。',
-  'captcha.failed': '验证码验证失败——请重试。',
+  'captcha.failed': "防机器人验证失败，请重试。",
 
   // Home
   'home.welcome': '欢迎使用 MeshBay',