fix(client): refresh the token when the node says "not a member"

A member added to a group after they signed in was refused by the node, told
"Not a member of this group", and had no way forward but to log out and back in.
The hub bakes `groups` into the access token at login and never pushes updates,
so the token said they were in nothing while the database said otherwise.

This lands on every newly invited member, at their first action, and the message
tells them the opposite of the truth — toto2 was a member of newdemo on the hub
and read that they were not.

The refusal now carries a code the client can act on (`not_a_member`) rather than
prose it would have to string-match, and the SPA refreshes the access token once
and retries. Refreshing re-reads membership from the database, so the retry
succeeds. Once per mount: if a fresh token still says not a member, that is the
truth and it gets shown.

The SPA had stored a refresh token since Phase 8 and never used it. It does now.

Found in a browser, doing the ordinary thing — the automated run never sees it,
because e2e.py logs in after being added to the group.

Tests: 233 node+common, including a handshake test that the refusal carries the
code, and the full e2e run against the live deployment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 271d11f..c200674 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -314,8 +314,13 @@ class MeshBayTransport {
     // A node that answers a handshake with anything other than a challenge is not
     // running the mutual protocol. Accepting a bare handshake_ack here would let a
     // peer skip proving GEK possession entirely (C3/C6).
-    throw new Error(
+    const rejected = new Error(
       'MNP handshake rejected: ' + (reply.detail || `unexpected ${reply.type}`));
+    // `not_a_member` usually means our token predates being added to the group;
+    // the caller refreshes it and tries again rather than showing that to someone
+    // who was invited thirty seconds ago.
+    rejected.reason = reply.code || '';
+    throw rejected;
   }
 
   /**