feat(client): Phase 2 — per-app settings panes, folder tree, multi-directory

Each app's settings were inlined in `group-settings.js` — TMDB, MusicBrainz,
and one folder picker per app, each with its own draft state and save handler
saying the same thing about a different key. They are one file per app now,
reached through the `apps.js` registry, and the page that renders them names no
application at all: adding one is a registry entry and a settings file.

The line between the two is what makes that true. What every app has — folders
— the page does generically, through one `saveDirectories` bound to the app.
What one app alone has, its pane does itself with the transport it is handed.
An app that only needs directories touches neither `group-settings.js` nor
`group-page.js`, which is `test_app_settings_plugin.py`'s subject.

`settings-ui.js` exists because a pane importing the page that renders it is a
cycle, and ES modules answer that with a temporal-dead-zone ReferenceError at
first render — a component that silently does not appear, the fault already
recorded in CLAUDE.md about hook ordering.

The flat depth-indented `<select>` of every folder in the library becomes a
modal tree. It asks the node for nothing: the tree is derived from paths the
client already holds, so it shows exactly what the group's index contains and
adds no folder-browsing protocol. For Chat's attachment folder — the one
directory that is written to rather than read — read-only roots are greyed
out, so the node's refusal arrives before the operator picks rather than when
somebody sends a file.

Videos and Music take a list of folders. A library on two drives could not be
described before; the only recourse was pointing the app at a parent containing
both, which pulls in everything else under it. The scalar shapes survive on the
wire alone, for a node speaking MNP 1.0, and the client reads them as a
one-element list.

Two things the tests caught that I would not have:

`test_asset_versioning` — six new modules were missing from `_ASSETS`. Reached
through the registry rather than imported by name, they are exactly the files
nothing else would notice changing, and a stale one is served from cache with
no version bump.

And `node --check foo.js` does **not** reliably report a module syntax error:
it accepted `${/* ... */''}` — htm template syntax pasted into a plain object
literal — and reported success. A `.mjs` copy forces the module parser and
reports it. The suite had no syntax check at all, which is how that reached a
file; `test_spa_syntax.py` does it for every module now, and pins that the
loose path is not what it uses.

Suite: 12 failures, all pre-existing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pvMdvLBG92jyhvD5pD6us

1 files changed, 85 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_spa_syntax.py b/packages/meshbay-hub/tests/test_spa_syntax.py
new file mode 100644
index 0000000..352f84b
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_spa_syntax.py
@@ -0,0 +1,85 @@
+"""
+Every SPA module parses.
+
+This is the cheapest possible test and the suite did not have it, which is how
+a `${/* ... */''}` — htm template syntax, pasted into a plain object literal —
+reached a committed file. Nothing else here would catch it: the source-reading
+guards (`test_hook_ordering`, `test_transport_contracts`, `test_spa_ordering`)
+match patterns in text that parses or does not, and the browser harnesses only
+load the few modules they need.
+
+**`node --check foo.js` is not the check.** It reports success on exactly the
+file above: given a `.js` extension it makes its own decision about how to
+parse, and a module-syntax error inside one can come back clean. Copying to
+`.mjs` first is what forces the module parser, and it is the difference
+between a green run and a real one — the same shape as the "a test that models
+a fix agrees with it by construction" note in CLAUDE.md, one level lower.
+
+It says nothing about names, imports resolving, or hooks being in order. Those
+have their own tests. This one only says the file is JavaScript.
+"""
+
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+
+pytestmark = pytest.mark.skipif(
+    shutil.which("node") is None or not STATIC.exists(),
+    reason="node or the SPA sources are not available")
+
+
+def _modules() -> list[Path]:
+    # vendor/ is third-party and shipped as-is; sw.js is a service worker, a
+    # classic script by definition, and transport.js is loaded with a plain
+    # <script> tag for the same historical reason (see its own header).
+    files = sorted(STATIC.glob("*.js")) + sorted((STATIC / "locales").glob("*.js"))
+    return [f for f in files if f.name not in ("sw.js",)]
+
+
+def test_every_module_parses(tmp_path):
+    broken: list[str] = []
+    for path in _modules():
+        # The .mjs copy is the whole point — see this module's docstring.
+        copy = tmp_path / (path.stem + ".mjs")
+        copy.write_text(path.read_text(encoding="utf-8"), encoding="utf-8")
+        proc = subprocess.run(["node", "--check", str(copy)],
+                              capture_output=True, text=True)
+        if proc.returncode != 0:
+            first = (proc.stderr or "").strip().splitlines()
+            detail = next((ln for ln in first if "Error" in ln), first[:1] and first[0] or "")
+            broken.append(f"{path.name}: {detail}")
+
+    assert not broken, "SPA modules that do not parse:\n" + "\n".join(broken)
+
+
+def test_the_check_would_notice_a_broken_file(tmp_path):
+    """
+    The test above passing means nothing unless it can fail, and the way it
+    fails is the interesting part: this same content in a file called `.js`
+    is reported as fine.
+    """
+    bad = "export const a = {\n  ${/* not object syntax */''}\n  b: 1,\n};\n"
+
+    as_js = tmp_path / "sample.js"
+    as_js.write_text(bad, encoding="utf-8")
+    lenient = subprocess.run(["node", "--check", str(as_js)],
+                             capture_output=True, text=True)
+
+    as_mjs = tmp_path / "sample.mjs"
+    as_mjs.write_text(bad, encoding="utf-8")
+    strict = subprocess.run(["node", "--check", str(as_mjs)],
+                            capture_output=True, text=True)
+
+    assert strict.returncode != 0, (
+        "the .mjs check no longer reports a module syntax error — this whole "
+        "test is then measuring nothing")
+    if lenient.returncode == 0:
+        # Recorded rather than asserted: this is a Node behaviour, and it
+        # improving would be good news, not a failure. The .mjs copy stays
+        # either way, because relying on the loose path is what let this
+        # through once already.
+        pass