feat: unified group management, public groups, and activity-based sidebar

Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces
into a single multi-step page: group creation on hub, node attachment, root
selection via folder picker, GEK initialization, and auto-pairing — all in one
flow. Browser SPA keeps its current behavior unchanged.

Public group support (Option A — GEK for all groups):
- All groups have GEK regardless of visibility; open-join groups auto-admit
  via TOFU when join_policy is "open"
- Key rotation blocked for public groups (API guard + UI hidden)
- Hub signaling allows WebRTC offers for nodes hosting open-join groups even
  when the caller isn't a member yet
- attach_group writes join_policy to node.toml
- Daemon loads GEK for all groups, not just private ones
- Known-device path in join_request now auto-admits to open-join groups

Node loopback API bridge (Electron IPC):
- node:detect, node:call, node:pairing-code IPC handlers in main process
- Renderer never sees tokens, paths, or keys (session token = physical access)
- platform.js node namespace for UI consumption
- Loopback endpoints: roots CRUD, member-upload toggle, reload

Bug fixes:
- Root change detection: removed premature ctx["roots"] updates from add_root
  and remove_root that prevented indexer retarget on reload
- Duplicate offline message: global fallback now gated on !group
- Signaling membership check: fallback to open-join groups for non-members

Sidebar groups sorted by last_activity_at (most recent first):
- New Group.last_activity_at column with Alembic migration
- POST /v1/groups/{id}/activity endpoint, called on connect and chat send
- Client-side sort + throttled hub updates (1/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 29 insertions, 2 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/platform.js b/packages/meshbay-hub/src/meshbay_hub/static/platform.js
index d379e9d..02107f5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/platform.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/platform.js
@@ -207,8 +207,35 @@ export const rootPicker = {
   async choose() { return bridge && bridge.rootPicker ? bridge.rootPicker.choose() : null; },
 };
 
+/**
+ * The local node, if one is running on this machine.
+ *
+ * Detection probes `127.0.0.1:{ui_port}` with the session token read from the
+ * daemon's data directory. The renderer never sees the token — it names an
+ * operation and the main process executes it, the same trust model as hub:fetch.
+ *
+ * In a browser all calls resolve to a "not available" result, so the interface
+ * can gate features on `node.available` without a build flag.
+ */
+export const node = {
+  available: Boolean(bridge && bridge.node),
+  async detect() {
+    return bridge && bridge.node ? bridge.node.detect() : { detected: false };
+  },
+  async call(method, path, body) {
+    if (!bridge || !bridge.node) throw new Error('Node bridge not available');
+    return bridge.node.call(method, path, body);
+  },
+  async pairingCode() {
+    return bridge && bridge.node ? bridge.node.pairingCode() : null;
+  },
+  async setPairingCode(code) {
+    return bridge && bridge.node ? bridge.node.setPairingCode(code) : false;
+  },
+};
+
 export default { isNative, hubBase, capabilities, secrets, nativeSave,
-                 apiFetch, device, bridgeMessage, folder, rootPicker };
+                 apiFetch, device, bridgeMessage, folder, rootPicker, node };
 
 // Also a global, because `transport.js` is loaded as a classic script — it
 // predates the module graph and exposes `MeshBayTransport` the same way. The
@@ -217,5 +244,5 @@ export default { isNative, hubBase, capabilities, secrets, nativeSave,
 if (typeof window !== 'undefined') {
   window.MeshBayPlatform = { isNative, hubBase, capabilities, secrets,
                              nativeSave, apiFetch, device,
-                             bridgeMessage, folder, rootPicker };
+                             bridgeMessage, folder, rootPicker, node };
 }