feat(client): hybrid sign-in — passphrase once, then this device's key

D4. The passphrase stays the account's credential and its only recovery path;
what changes is that it is not asked for on every launch.

**The renderer never holds the device key.** It is generated, stored and used
entirely in the main process, which signs `meshbay:user_auth:<username>:<ts>` on
request. Same rule as the save dialog, for the same reason: the renderer is the
part of this application that parses decrypted content from nodes, which is
attacker-controlled input. And this key is *not* a per-node identity key — those
are generated per node and never leave that relationship, so nothing here
correlates a person across operators.

First run asks which hub, with no default. A client that picks its own hub is a
client that can be pointed at one, and the address is the whole of what this
application trusts a hub for — the interface comes from the package.

Verified against a hub running this code, not against the deployed one:
register 201 → passphrase login 200 → device register 201 → **device sign-in 200
with a real session** → `/v1/users/me` 200 → a stranger's key 401. The
signature was also checked directly against the hub's own Python verifier before
any of that.

Inside the running application, over the debugging protocol: the bridge reaches
the main process, the renderer calls the hub **through it** (200 — the CORS fix
working end to end), and a call to a host that is not the configured hub is
refused.

**Not verified:** safeStorage persisting the key. This session has no secret
service, and standing one up in xvfb did not succeed. The application behaves
correctly there — it *refuses* rather than storing unprotected, and now says so
in Settings, which is a real case rather than a hypothetical one since it is
exactly what a headless or minimal desktop looks like.

Worth remembering for next time: meshbay.org runs whatever was last deployed. It
answered 405 on the Stage-C endpoints and reported MNP 0.2 while the tree had
0.3, so a local `uvicorn meshbay_hub.app:create_app --factory` on SQLite is what
tests hub changes. Nothing was deployed to production for this.

799 tests pass; e2e.py passes end to end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

10 files changed, 60 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index ae356ba..8b652b5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -198,9 +198,15 @@ export default {
   'settings.theme_system': 'System',
   'settings.language': 'Sprache',
   'settings.about': 'Über',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Version',
   'settings.protocol': 'Protokoll',
   'settings.role': 'Rolle',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index fe6bd0f..9018384 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -190,9 +190,15 @@ export default {
   'settings.theme_system': 'System',
   'settings.language': 'Language',
   'settings.about': 'About',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Version',
   'settings.protocol': 'Protocol',
   'settings.role': 'Role',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 3066963..32e5f8a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -194,9 +194,15 @@ export default {
   'settings.theme_system': 'Sistema',
   'settings.language': 'Idioma',
   'settings.about': 'Acerca de',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Versión',
   'settings.protocol': 'Protocolo',
   'settings.role': 'Rol',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index c94089d..6517a7c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -198,9 +198,15 @@ export default {
   'settings.theme_system': 'Système',
   'settings.language': 'Langue',
   'settings.about': 'À propos',
+  'firstrun.title': 'Quel hub ?',
+  'firstrun.hint': 'Un hub détient votre compte et vous met en relation avec les nœuds. Il ne voit ni vos fichiers, ni vos messages, ni vos clés.',
+  'firstrun.btn': 'Continuer',
+  'firstrun.note': 'Il n’y a volontairement pas de valeur par défaut : cette application ne fait confiance à un hub que pour son API, jamais pour l’interface, qui est livrée avec l’application.',
+  'device.this_device': 'Cet appareil',
   'settings.keys_heading': 'Clés sur cet appareil',
   'settings.keys_where': 'Protégées par',
   'settings.keys_unprotected': 'Aucun trousseau système ne fonctionne : vos clés sont chiffrées avec une clé qui n’est pas secrète. Quiconque peut lire les fichiers de cette machine peut les lire. Démarrez un trousseau, ou considérez cet appareil comme non fiable.',
+  'settings.keys_unavailable': 'Ce système n’offre aucun stockage de clés, donc cet appareil ne peut pas être mémorisé — votre phrase secrète vous sera redemandée à chaque fois. C’est le comportement sûr : rien n’a été stocké sans protection.',
   'settings.version': 'Version',
   'settings.protocol': 'Protocole',
   'settings.role': 'Rôle',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 56beb8d..470801d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -197,9 +197,15 @@ export default {
   'settings.theme_system': 'Sistema',
   'settings.language': 'Lingua',
   'settings.about': 'Informazioni',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Versione',
   'settings.protocol': 'Protocollo',
   'settings.role': 'Ruolo',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 5d83bb9..33bdc46 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -192,9 +192,15 @@ export default {
   'settings.theme_system': 'システムに合わせる',
   'settings.language': '言語',
   'settings.about': 'このアプリについて',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'バージョン',
   'settings.protocol': 'プロトコル',
   'settings.role': '権限',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 55c7d81..56a2c9f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -198,9 +198,15 @@ export default {
   'settings.theme_system': 'Systeem',
   'settings.language': 'Taal',
   'settings.about': 'Over',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Versie',
   'settings.protocol': 'Protocol',
   'settings.role': 'Rol',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index 3cf909f..31e5c13 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -204,9 +204,15 @@ export default {
   'settings.theme_system': 'Systemowy',
   'settings.language': 'Język',
   'settings.about': 'O programie',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Wersja',
   'settings.protocol': 'Protokół',
   'settings.role': 'Rola',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 714dff6..d6563ab 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -196,9 +196,15 @@ export default {
   'settings.theme_system': 'Sistema',
   'settings.language': 'Idioma',
   'settings.about': 'Sobre',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': 'Versão',
   'settings.protocol': 'Protocolo',
   'settings.role': 'Função',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index c3d9494..a7bbb0e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -183,9 +183,15 @@ export default {
   'settings.theme_system': '跟随系统',
   'settings.language': '语言',
   'settings.about': '关于',
+  'firstrun.title': 'Which hub?',
+  'firstrun.hint': 'A hub holds your account and introduces you to nodes. It never sees your files, your messages or your keys.',
+  'firstrun.btn': 'Continue',
+  'firstrun.note': 'There is no default on purpose: this application only trusts a hub for its API, never for the interface, which ships with the application itself.',
+  'device.this_device': 'This device',
   'settings.keys_heading': 'Keys on this device',
   'settings.keys_where': 'Protected by',
   'settings.keys_unprotected': 'No system keyring is running, so your keys are encrypted with a key that is not a secret. Anyone who can read this machine’s files can read them. Start a keyring, or treat this device as untrusted.',
+  'settings.keys_unavailable': 'This system offers no key storage at all, so this device cannot be remembered — you will be asked for your passphrase each time. That is the safe outcome: nothing was stored unprotected.',
   'settings.version': '版本',
   'settings.protocol': '协议',
   'settings.role': '角色',