feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/conftest.py b/packages/meshbay-hub/tests/conftest.py
index bb0ed28..5104ae2 100644
--- a/packages/meshbay-hub/tests/conftest.py
+++ b/packages/meshbay-hub/tests/conftest.py
@@ -29,6 +29,7 @@ def hub_key_path(tmp_path_factory) -> Path:
 @pytest.fixture
 def hub_config(hub_key_path, tmp_path):
     from meshbay_hub.config import (
+        CaptchaConfig,
         DatabaseConfig,
         HubConfig,
         HubIdentityConfig,
@@ -40,6 +41,9 @@ def hub_config(hub_key_path, tmp_path):
         server=ServerConfig(host="127.0.0.1", port=8000),
         identity=HubIdentityConfig(id="test-hub", private_key_path=hub_key_path),
         jwt=JWTConfig(access_token_ttl=3600),
+        # Off here, so every test that registers is not also solving a proof of
+        # work; test_register_captcha.py turns it on.
+        captcha=CaptchaConfig(enabled=False),
     )
     return cfg