feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/packages/meshbay-hub/tests/test_unauthenticated_surface.py b/packages/meshbay-hub/tests/test_unauthenticated_surface.py
index aabcf45..f78f327 100644
--- a/packages/meshbay-hub/tests/test_unauthenticated_surface.py
+++ b/packages/meshbay-hub/tests/test_unauthenticated_surface.py
@@ -27,10 +27,11 @@ PUBLIC = {
     ("GET", "/"): "the application shell",
     ("GET", "/app"): "the application shell",
     ("GET", "/app/{path:path}"): "the application shell",
-    ("GET", "/v1/hub/info"): "read before sign-in: captcha key, instance policy",
+    ("GET", "/v1/hub/info"): "read before sign-in: instance policy",
     ("GET", "/v1/hub/version"): "an installed client checks its minimum version first",
     ("GET", "/v1/hub/pubkey"): "nodes cache the hub key on first contact",
     ("GET", "/v1/health"): "supervision",
+    ("GET", "/v1/users/captcha"): "a proof-of-work challenge for sign-up and reset, per-IP limit",
     ("POST", "/v1/users/register"): "obtains an account — captcha, per-IP limit",
     ("POST", "/v1/users/login"): "obtains a session — per-IP limit, per-name lockout",
     ("POST", "/v1/users/auth"): "device sign-in — Ed25519 signature over a fresh timestamp",