feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

3 files changed, 59 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index c1697a7..bb88283 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -25,6 +25,7 @@ On receipt: immediately refuse JWT tokens matching the revoked user_id,
 and close active connections for that user.
 """
 
+import asyncio
 import base64
 import json
 import logging
@@ -50,6 +51,7 @@ router = APIRouter(tags=["revocation"])
 # ── Connected node registry ───────────────────────────────────────────────────
 
 _connected_nodes: dict[str, WebSocket] = {}   # node_id → websocket
+_punch_events: dict[str, asyncio.Event] = {}  # node_id → signaling event
 
 
 def get_connected_node_count() -> int:
@@ -122,12 +124,16 @@ async def node_websocket(ws: WebSocket):
         log.info("Node WS connected: %s", node_id[:8])
         await ws.send_text(json.dumps({"type": "auth_ok", "node_id": node_id}))
 
-        # Keep-alive loop — wait for ping or disconnect
+        # Message loop — handle ping, punch_ready, etc.
         while True:
             raw = await ws.receive_text()
             msg = json.loads(raw)
             if msg.get("type") == "ping":
                 await ws.send_text(json.dumps({"type": "pong"}))
+            elif msg.get("type") == "punch_ready":
+                event = _punch_events.get(node_id)
+                if event:
+                    event.set()
 
     except WebSocketDisconnect:
         log.info("Node WS disconnected: %s", (node_id or "unknown")[:8])
@@ -140,6 +146,44 @@ async def node_websocket(ws: WebSocket):
 
 # ── Admin revocation endpoint ─────────────────────────────────────────────────
 
+class IncomingRequest(BaseModel):
+    peer_ip:   str
+    peer_port: int
+
+
+@router.post("/v1/nodes/{node_id}/incoming", status_code=200)
+async def notify_incoming(
+    node_id: str,
+    body: IncomingRequest,
+    current_user: User = Depends(get_current_user),
+):
+    """
+    Signal a node that a client wants to connect (NAT punch coordination).
+    Hub forwards the request via WebSocket; node punches NAT and replies punch_ready.
+    """
+    ws = _connected_nodes.get(node_id)
+    if not ws:
+        raise HTTPException(status_code=404, detail="Node not connected")
+
+    event = asyncio.Event()
+    _punch_events[node_id] = event
+
+    await ws.send_text(json.dumps({
+        "type": "client_incoming",
+        "peer_ip": body.peer_ip,
+        "peer_port": body.peer_port,
+    }))
+
+    try:
+        await asyncio.wait_for(event.wait(), timeout=5.0)
+    except asyncio.TimeoutError:
+        raise HTTPException(status_code=504, detail="Node did not respond in time")
+    finally:
+        _punch_events.pop(node_id, None)
+
+    return {"status": "ready", "node_id": node_id}
+
+
 class RevokeRequest(BaseModel):
     target:    str   # "user" or "group"
     target_id: str
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 5a7a3b4..5a2c7be 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -18,7 +18,7 @@ from meshbay_hub.auth import (
 )
 from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import IPLog, RefreshToken, User
+from meshbay_hub.db.models import GroupMember, IPLog, RefreshToken, User
 from meshbay_hub.api.deps import get_current_user
 
 router = APIRouter(prefix="/v1/users", tags=["users"])
@@ -136,7 +136,11 @@ async def login(
     if user.status != "active":
         raise HTTPException(status_code=403, detail=f"Account {user.status}")
 
-    access_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl())
+    memberships = await db.execute(
+        select(GroupMember.group_id).where(GroupMember.user_id == user.id))
+    group_ids = [gid for (gid,) in memberships.all()]
+    access_token = issue_access_token(
+        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
     raw_rt, rt_hash = generate_refresh_token()
 
     expires_at = datetime.now(timezone.utc) + timedelta(seconds=_refresh_ttl())
@@ -175,7 +179,11 @@ async def token_refresh(
     if not user or user.status != "active":
         raise HTTPException(status_code=401, detail="User not found or suspended")
 
-    new_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl())
+    memberships = await db.execute(
+        select(GroupMember.group_id).where(GroupMember.user_id == user.id))
+    group_ids = [gid for (gid,) in memberships.all()]
+    new_token = issue_access_token(
+        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
     return {"access_token": new_token, "token_type": "bearer", "expires_in": _ttl()}
 
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index a4c3bfb..2b2c61e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -105,10 +105,12 @@ def issue_access_token(
     user_id: str,
     pk_user: str,
     ttl: int = 3600,
+    groups: list[str] | None = None,
 ) -> str:
     """
     Issue a signed JWT access token.
     Includes jti (UUID4) — required to prevent replay and enable revocation.
+    Includes groups — list of group_ids the user is a member of (node-side authz).
     """
     if _hub_sk_pem is None:
         raise RuntimeError("Hub keypair not loaded")
@@ -121,6 +123,7 @@ def issue_access_token(
         "jti":     str(uuid.uuid4()),
         "iat":     now,
         "exp":     now + ttl,
+        "groups":  groups or [],
     }
     return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA")